Log detection method and device, electronic equipment, vehicle and medium
By filtering and enhancing key parameters in log detection, and combining long short-term memory networks and convolutional neural networks for synchronous detection, the problem of single detection dimension is solved, and the accuracy of log detection and fault detection is improved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- GUANGZHOU AUTOMOBILE GROUP CO LTD
- Filing Date
- 2025-12-05
- Publication Date
- 2026-04-21
AI Technical Summary
Existing log detection methods rely solely on template identifier sequence detection, resulting in a single detection dimension and an inability to identify abnormal parameter values, thus leading to insufficient detection accuracy.
By filtering key parameters from the original logs and adding them to the original logs to form enhanced logs, log parsing and anomaly detection models, including long short-term memory networks and convolutional neural networks, are used to simultaneously detect structural features and parameter values.
It enables synchronous detection of log structure features and parameter values, improving the accuracy of log detection results and fault detection accuracy, and avoiding missed fault detection due to parameter loss.
Smart Images
Figure CN121901008A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of log analysis technology, and in particular to a log detection method, apparatus, electronic device, vehicle, and medium. Background Technology
[0002] Currently, log detection typically inputs the current log key sequence from vehicle logs into a log sequence prediction model to predict the next log key, and compares it with the actual log key to determine if the log key is normal. However, this method can only detect structured data through template identifier sequences, resulting in a single detection dimension and an inability to identify abnormal parameter values. Summary of the Invention
[0003] This application provides a log detection method, apparatus, electronic device, vehicle, and medium, aiming to improve the technical problem in the prior art that it only relies on template identifier sequence to detect structural data, resulting in a single detection dimension and inability to identify abnormal parameter values.
[0004] A log detection method, comprising: Key parameters are filtered out from the original logs and added to the original logs to obtain enhanced logs; Log parsing is performed on the original log and the enhanced log to obtain basic template information corresponding to the original log and enhanced template information corresponding to the enhanced log; Anomaly detection is performed on the basic template information and the enhanced template information to obtain log detection results.
[0005] In this embodiment, the log detection method retains key parameters by filtering them from the original logs. Adding these key parameters to the original logs enhances them, preventing parameter loss during subsequent processing and avoiding missed fault detections. Log parsing extracts key information from both the original and enhanced logs, enabling the determination of basic and enhanced template information. This allows for the simultaneous detection of structural features and parameter values, solving the problem of single-dimensional detection and inability to identify parameter anomalies, thus improving the accuracy of log detection results.
[0006] Furthermore, the step of filtering key parameters from the original log and adding the key parameters to the original log to obtain enhanced logs includes: Parameter values exceeding a preset parameter threshold are filtered out from the original logs, and the parameter values and the parameter names corresponding to the parameter values are identified as key parameters; The key parameters are added to the original log as append fields to obtain the enhanced log.
[0007] In this embodiment, key parameters in the original log are determined by setting preset parameter thresholds. All key parameters are then appended to the original log as fields, enhancing the log and preventing parameter loss that could lead to missed fault detection.
[0008] Further, the step of parsing the original log and the enhanced log to obtain basic template information corresponding to the original log and enhanced template information corresponding to the enhanced log includes: The original log is processed to obtain an original log template, and the basic template information is determined based on the original log template. The enhanced log is processed to obtain an enhanced log template, and the enhanced template information is determined based on the enhanced log template.
[0009] In this embodiment, variable processing is used to obtain the original log template and the enhanced log template, thereby determining the basic template information and the enhanced template information, and thus retaining the key parameters, avoiding the problem of missing fault detection due to parameter loss.
[0010] Furthermore, the step of performing anomaly detection on the basic template information and the enhanced template information to obtain log detection results includes: The original identifier information in the basic template information and the enhanced identifier information in the enhanced template information are vectorized to obtain an identifier sequence; The original parameter values in the basic template information and the enhanced parameter values in the enhanced template information are vectorized to obtain a parameter sequence. Determine the log feature vector based on the identifier sequence and the parameter sequence; Anomaly detection is performed on the log feature vector to obtain the log detection results.
[0011] In this embodiment, by vectorizing the basic template information and the enhanced template information, the identification sequence and parameter sequence are determined, thereby enabling the acquisition of log feature vectors that simultaneously characterize log structure features and parameter value distribution features. This, in turn, enables anomaly detection of log feature vectors and improves the accuracy of fault detection.
[0012] Further, the step of performing anomaly detection on the log feature vector to obtain log detection results includes: The log feature vector is input into the log detection model; the log detection model includes a long short-term memory network for detecting identifier sequences and a convolutional neural network for detecting parameter sequences; The Long Short-Term Memory network is used to perform anomaly detection on the identifier sequence to obtain the identifier detection result; The parameter sequence is subjected to anomaly detection using the convolutional neural network to obtain parameter detection results; The log detection result is determined based on the identifier detection result and the parameter detection result.
[0013] In this embodiment, anomaly detection of the identifier sequence and parameter sequence is performed by a log detection model, which solves the problem of single detection dimension and inability to identify parameter anomalies. This enables synchronous detection of structural data and parameter data, thereby improving the accuracy of log detection results and the accuracy of fault detection.
[0014] Further, determining the log detection result based on the identifier detection result and the parameter detection result includes: The identifier detection result and the parameter detection result are weighted to obtain the log detection score; When the log detection score exceeds a preset anomaly threshold, a log detection result representing an anomaly in the original log is obtained; When the log detection score does not exceed the preset anomaly threshold, a log detection result indicating that the original log is normal is obtained.
[0015] In this embodiment, the log detection score is calculated by weighting the identifier detection results and parameter detection results, thereby improving the accuracy of the log detection score. By setting a preset anomaly threshold, anomaly assessment of the logs is achieved, further improving the accuracy of the log detection results and the overall accuracy of fault detection.
[0016] A log detection device, comprising: The log enhancement module is used to filter out key parameters from the original log and add the key parameters to the original log to obtain enhanced log; The log parsing module is used to parse the original log and the enhanced log to obtain basic template information corresponding to the original log and enhanced template information corresponding to the enhanced log. The detection result module is used to perform anomaly detection on the basic template information and the enhanced template information to obtain log detection results.
[0017] An electronic device includes a processor and a memory, wherein, Memory, used to store computer programs; The processor is used to execute the program stored in the memory to implement the above-mentioned log detection method.
[0018] A vehicle that includes the aforementioned electronic equipment.
[0019] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described log detection method. Attached Figure Description
[0020] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0021] Figure 1 This is a flowchart of a log detection method provided in an embodiment of this application; Figure 2 This is a flowchart illustrating step S101 of the log detection method provided in an embodiment of this application; Figure 3 This is a flowchart illustrating step S102 of the log detection method provided in an embodiment of this application; Figure 4 This is a flowchart illustrating step S103 of the log detection method provided in an embodiment of this application; Figure 5 This is a flowchart illustrating step S404 of the log detection method provided in an embodiment of this application; Figure 6 This is a schematic diagram of the structure of a log detection device provided in an embodiment of this application; Figure 7 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation
[0022] To make the technical problems, technical solutions, and beneficial effects solved by this application clearer, the following detailed description is provided in conjunction with embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.
[0023] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0024] In one embodiment, please refer to Figure 1 A log detection method is provided, including the following steps S101-S103: S101. Filter out key parameters from the original log and add the key parameters to the original log to obtain the enhanced log.
[0025] S102. Perform log parsing on the original log and the enhanced log to obtain basic template information corresponding to the original log and enhanced template information corresponding to the enhanced log.
[0026] S103. Perform anomaly detection on the basic template information and the enhanced template information to obtain log detection results.
[0027] The original log is an electronic document recording the vehicle's operating status, operational events, and system diagnostic information. The enhanced log is an electronic document that enhances the variable parameters in the original log. Key parameters refer to parameter data in the original log that exceed preset thresholds, along with their corresponding names, such as vehicle speed 120, temperature 95, etc. There can be one or multiple key parameters. Basic template information refers to the log identifier and parameter values extracted from the original log. Enhanced template information refers to the log identifier and parameter values extracted from the enhanced log. Log detection results are used to characterize whether the original log is normal.
[0028] As an example, in step S101, the original log is obtained. All parameter values exceeding the preset parameter thresholds are filtered out from the original log, and all parameter values and their corresponding names are identified as key parameters. Then, all key parameters are reinserted into the original log to enhance its parameters, resulting in an enhanced log.
[0029] As an example, in step S102, log parsing is performed on both the original log and the enhanced log. Specifically, variables in the original and enhanced logs are first replaced with placeholders (e.g., * asterisk, # hash). Then, the original key data is extracted from the processed original log, and this extracted key data is used as the basic template information corresponding to the original log. Similarly, enhanced key data is extracted from the processed enhanced log, and this extracted key data is used as the enhanced template information corresponding to the enhanced log.
[0030] As an example, in step S103, the original identifier information and original parameter values are first extracted from the basic template information, and the enhanced identifier information and enhanced parameter values are extracted from the enhanced template information. Then, vector processing is performed on the original identifier information, original parameter values, enhanced identifier information, and enhanced parameter values to obtain the log feature vector. Finally, anomaly detection is performed on the log structure features and parameter value distribution features in the log feature vector to obtain the log detection result.
[0031] In this embodiment, the log detection method retains key parameters by filtering them from the original logs. Adding these key parameters to the original logs enhances them, preventing parameter loss during subsequent processing and avoiding missed fault detections. Log parsing extracts key information from both the original and enhanced logs, enabling the determination of basic and enhanced template information. This allows for the simultaneous detection of structural features and parameter values, solving the problem of single-dimensional detection and inability to identify parameter anomalies, thus improving the accuracy of log detection results.
[0032] In one embodiment, please refer to Figure 2 In step S101, determining the enhanced log based on the original log includes: S201. Filter out parameter values that exceed a preset parameter threshold from the original log, and determine the parameter values and the parameter names corresponding to the parameter values as key parameters.
[0033] S202. The key parameters are added to the original log as append fields to obtain the enhanced log.
[0034] Here, "parameter value" refers to the specific numerical value of each parameter, such as a vehicle speed of 120 kilometers per hour and a temperature of 90 degrees Celsius. "Parameter name" refers to the name of each parameter in the log, such as time, vehicle speed, temperature, etc. "Preset parameter threshold" refers to the threshold value corresponding to each parameter in the log, such as a vehicle speed threshold of 100 kilometers per hour. All preset parameter thresholds can be stored in a threshold table for easy querying.
[0035] As an example, in step S201, all preset parameter thresholds are obtained, and all parameter values are extracted from the original logs. The parameter values corresponding to the same parameter name are then compared with the preset parameter thresholds. When a parameter value is greater than the preset parameter threshold, the parameter name and value corresponding to that parameter value are identified as key parameters. In this way, all key parameters are filtered out from the original logs. Conversely, when a parameter value is less than or equal to the preset parameter threshold, the parameter name and value corresponding to that parameter value are identified as non-key parameters.
[0036] In one example, key-value pairs corresponding to key parameters are retrieved, and the other parameter in each key-value pair is designated as the key parameter. For instance, if the key parameter is vehicle speed, and the other parameter in the key-value pair is engine speed, then vehicle speed and engine speed form a key-value pair. If the vehicle speed is 120 km / h and the engine speed is 3000 RPM, when the vehicle speed exceeds a preset threshold, both vehicle speed and engine speed are designated as key parameters.
[0037] As an example, in step S202, all key parameters extracted from the original log are re-inserted into the original log as append fields to obtain an enhanced log. For example, the format of the append field is [parameter name]_ENCODED:[value], such as vehicle speed_ENCODED:120.
[0038] In one example, all key parameters are appended as fields to the end of each original log entry to create an enhanced log. For instance, if the original log is ECU_ERR|vehicle speed:120|rpm:3000, and the appended field is vehicle speed_ENCODED:120, then the enhanced log will be ECU_ERR|vehicle speed:120|rpm:3000|vehicle speed_ENCODED:120.
[0039] In this embodiment, key parameters in the original log are determined by setting preset parameter thresholds. All key parameters are then appended to the original log as fields, enhancing the log and preventing parameter loss that could lead to missed fault detection.
[0040] In one embodiment, please refer to Figure 3 In step S102, the process of parsing the original log and the enhanced log to obtain basic template information corresponding to the original log and enhanced template information corresponding to the enhanced log includes: S301. Perform variable processing on the original log to obtain the original log template, and determine the basic template information based on the original log template.
[0041] S302. Perform variable processing on the enhanced log to obtain an enhanced log template, and determine the enhanced template information based on the enhanced log template.
[0042] The original log template refers to the log after replacing the parameter values in the variable section of the original log with placeholders (e.g., * asterisk, # hash). The enhanced log template refers to the log after replacing the parameter values in the variable section of the enhanced log with placeholders (e.g., * asterisk, # hash), while retaining the key parameters that were re-inserted.
[0043] As an example, in step S301, the constant portion (such as parameter names) and the variable portion (parameter values) in the original log are filtered out. Then, the variable portion is processed; specifically, placeholders are used to replace the parameter values in the variable portion, thus obtaining the original log template. For example, if the original log is ECU_ERR|vehicle speed:120|RPM:3000, the variable portion is vehicle speed:120 and RPM:3000, and the original log template is ID001: ECU_ERR|vehicle speed:<*>|RPM:<*>. Then, key data is extracted from the original log template to obtain the basic template information. For example, the key data ID 001 is extracted from ID001:ECU_ERR|vehicle speed:<*>|RPM:<*> in the original log template.
[0044] As an example, in step S302, the constant and variable parts of the enhanced log are filtered out, and then the variable parts are processed. Specifically, the parameter values in the variable parts are replaced with placeholders to obtain the enhanced log template. For example, the enhanced log is ECU_ERR|vehicle speed:120|RPM:3000|Vehicle speed_ENCODED:120, and the variable parts are vehicle speed:120 and RPM:3000, ID105: ECU_ERR|Vehicle speed:<*>|RPM:<*>|Vehicle speed_ENCODED:120. Then, key data is extracted from the enhanced log template to obtain the enhanced template information. For example, from ID105: ECU_ERR|Vehicle speed:<*>|RPM:<*>|Vehicle speed_ENCODED:120, the ID 001 and the vehicle speed 120 are extracted.
[0045] In one example, the raw log is cleaned (e.g., redundant symbols are removed, and the format is standardized) and key elements are extracted: the log is split into a series of elements by spaces (e.g., operators, paths, parameters, etc.), clarifying the basic building blocks of the log. Then, using the log length (number of elements) as the first-level index and the first element as the second-level index, potential matching clusters are quickly located (reducing invalid comparisons). Elements of the new log are compared element-by-element with elements of existing clusters to identify constant and variable parts.
[0046] In this embodiment, variable processing is used to obtain the original log template and the enhanced log template, thereby determining the basic template information and the enhanced template information, and thus retaining the key parameters, avoiding the problem of missing fault detection due to parameter loss.
[0047] In one embodiment, please refer to Figure 4 In step S103, the vectorization processing of the basic template information and the enhanced template information to obtain the log feature vector includes: S401. The original identifier information in the basic template information and the enhanced identifier information in the enhanced template information are vectorized to obtain an identifier sequence.
[0048] S402. The original parameter values in the basic template information and the enhanced parameter values in the enhanced template information are vectorized to obtain a parameter sequence.
[0049] S403. Determine the log feature vector based on the identifier sequence and the parameter sequence.
[0050] S404. Perform anomaly detection on the log feature vector to obtain the log detection result.
[0051] In this context, the original identifier information refers to the identifier information in the basic template information. For example, if the basic template information includes 001, the identifier information is 001. Enhanced identifier information refers to the identifier information in the enhanced template information. For example, if the enhanced template information includes 105 and 120, the identifier information is 105. The identifier sequence is the vector representation of all identifier information. The parameter sequence is the vector representation of all parameter numbers. The log feature vector is a numerical vector used to represent the key features of the log. In this embodiment, the log feature vector simultaneously represents the log structural features and the parameter numerical distribution features.
[0052] As an example, in step S401, the original identifier information in the basic template information and the enhanced identifier information in the enhanced template information are extracted respectively. Then, the original identifier information and the enhanced identifier information are vector encoded to obtain the identifier sequence.
[0053] As an example, in step S402, the original parameter values in the basic template information and the enhanced parameter values in the enhanced template information are extracted respectively. Then, the original parameter values and the enhanced parameter values are vector-encoded to obtain the parameter sequence.
[0054] In one example, the original and enhanced identifier information are vector-encoded using one-hot encoding to obtain the identifier sequence. Similarly, the original and enhanced parameter values are vector-encoded using one-hot encoding to obtain the parameter sequence.
[0055] As an example, in step S403, the identifier sequence and parameter sequence are concatenated as vectors in the order of identifier sequence first and parameter sequence last to obtain the log feature vector. For example, if the identifier sequence is [001, 105] and the parameter sequence is [120, 95], concatenating the identifier sequence and parameter sequence as vectors will result in the log feature vector [001, 105, 120, 95].
[0056] In one example, the log feature vector is obtained by concatenating the parameters first and the identifiers last. For example, the log feature vector is [120, 95, 001, 105].
[0057] As an example, in step S404, anomaly detection is performed on the log structure features and parameter value distribution features in the log feature vector, respectively, to obtain the identifier detection result corresponding to the log structure features and the parameter detection result corresponding to the parameter value distribution features. Then, the identifier detection result corresponding to the log structure features and the parameter detection result corresponding to the parameter value distribution features are weighted and summed to obtain the log detection score. Next, if the log detection score does not exceed a preset anomaly threshold, a log detection result indicating that the original log is normal is determined. If the log detection score exceeds the preset anomaly threshold, a log detection result indicating that the original log is abnormal is determined.
[0058] In this embodiment, by vectorizing the basic template information and the enhanced template information, the identification sequence and parameter sequence are determined, thereby enabling the acquisition of log feature vectors that simultaneously characterize log structure features and parameter value distribution features. This, in turn, enables anomaly detection of log feature vectors and improves the accuracy of fault detection.
[0059] In one embodiment, please refer to Figure 5 In step S404, the anomaly detection of the log feature vector to obtain the log detection result includes: S501. Input the log feature vector into the log detection model; the log detection model includes a long short-term memory network for detecting identifier sequences and a convolutional neural network for detecting parameter sequences.
[0060] S502. Anomaly detection is performed on the identifier sequence through the Long Short-Term Memory network to obtain the identifier detection result.
[0061] S503. Anomaly detection is performed on the parameter sequence using the convolutional neural network to obtain parameter detection results.
[0062] S504. Determine the log detection result based on the identifier detection result and the parameter detection result.
[0063] The log feature vector includes an identifier sequence and a parameter sequence. The log detection model includes a Long Short-Term Memory (LSTM) network for detecting the identifier sequence and a Convolutional Neural Network (CNN) for detecting the parameter sequence. LSTM is a special type of Recurrent Neural Network (RNN) used to address the vanishing or exploding gradient problems of traditional RNNs when processing long data sequences, enabling the network to learn long-term dependencies. CNN is a deep learning model used to process grid-structured data. The identifier detection result refers to the score of the log structure features output by the LSTM network. The parameter detection result refers to the score of the parameter numerical distribution features output by the CNN.
[0064] As an example, in step S501, a log detection model is obtained, and the log feature vector is input into the log detection model to perform anomaly detection on the log feature vector through the log detection model.
[0065] As an example, in step S502, in multiple hidden layers of the Long Short-Term Memory (LSTM) network, the hidden state of the previous layer is used as the input to the corresponding LSTM block in the next layer to perform anomaly detection on the labeled sequence. Specifically, the input gate in the LSTM block determines the new information to be added to the cell state, and the forget gate in the LSTM block obtains the current state and historical state, inputs the forgetting degree to the cell state, thereby determining the information to be discarded in the cell state. The output gate in the LSTM block determines the information to be output from the cell state. After passing through multiple hidden layers, the labeled detection result is obtained. It is also necessary to input the hidden state of the previous LSTM block in the previous layer into the current LSTM block, and use the hidden state of the current LSTM block as the input to the corresponding LSTM block in the next layer.
[0066] As an example, in step S503, feature extraction of the parameter sequence is performed through convolutional layers in a convolutional neural network to obtain convolutional features. Then, pooling is applied to these convolutional features to reduce data dimensionality, i.e., feature compression, extracting key features, increasing translation invariance, and reducing the risk of overfitting, thus obtaining pooled features. Finally, the pooled features are used for prediction processing through fully connected layers to obtain the parameter detection results. The convolutional neural network can be a deep convolutional neural network comprising multiple convolutional layers and multiple pooling layers.
[0067] In one example, the normal distribution sequence of parameter values is obtained. Anomaly detection is performed on the parameter sequence and the normal distribution sequence using a convolutional neural network, that is, values that exceed normal fluctuations are filtered out to obtain abnormal values. The abnormal values are then evaluated by score to obtain the parameter detection results.
[0068] As an example, in step S504, the log detection score is obtained by weighted summation of the identifier detection result and the parameter detection result. When the log detection score exceeds a preset anomaly threshold, a log detection result indicating an anomaly in the original log is obtained. When the log detection score does not exceed the preset anomaly threshold, a log detection result indicating a normal original log is obtained.
[0069] In this embodiment, anomaly detection of the identifier sequence and parameter sequence is performed by a log detection model, which solves the problem of single detection dimension and inability to identify parameter anomalies. This enables synchronous detection of structural data and parameter data, thereby improving the accuracy of log detection results and the accuracy of fault detection.
[0070] In one embodiment, step S504, determining the log detection result based on the identifier detection result and the parameter detection result, includes: S5041. The identification detection result and the parameter detection result are weighted to obtain the log detection score.
[0071] S5042. When the log detection score exceeds the preset anomaly threshold, a log detection result representing the anomaly of the original log is obtained.
[0072] S5043. When the log detection score does not exceed the preset abnormal threshold, a log detection result indicating that the original log is normal is obtained.
[0073] The log detection score refers to the score used to characterize the degree of anomaly in the original logs.
[0074] As an example, in step S5041, the first weight corresponding to the Long Short-Term Memory network and the second weight corresponding to the convolutional neural network are obtained. The product of the identifier detection result and the first weight and the product of the parameter detection result and the second weight are added together, and the sum is determined as the log detection score.
[0075] In one example, the sum of the first weight and the second weight is one, and the first weight is greater than the second weight.
[0076] As an example, in step S5042, a preset anomaly threshold is obtained, and the log detection score is compared with the preset anomaly threshold. When the log detection score is greater than the preset anomaly threshold, it is determined that the log detection score exceeds the preset anomaly threshold, and a log detection result representing the original log anomaly is obtained.
[0077] As an example, in step S5043, when the log detection score is less than or equal to a preset anomaly threshold, it is determined that the log detection score has not exceeded the preset anomaly threshold, and a log detection result representing that the original log is normal is obtained.
[0078] In this embodiment, the log detection score is calculated by weighting the identifier detection results and parameter detection results, thereby improving the accuracy of the log detection score. By setting a preset anomaly threshold, anomaly assessment of the logs is achieved, further improving the accuracy of the log detection results and the overall accuracy of fault detection.
[0079] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.
[0080] This application also provides a log detection device 60, please refer to... Figure 6 ,include: The log enhancement module 601 is used to filter out key parameters from the original log and add the key parameters to the original log to obtain an enhanced log; The log parsing module 602 is used to parse the original log and the enhanced log to obtain basic template information corresponding to the original log and enhanced template information corresponding to the enhanced log. The detection result module 603 is used to perform anomaly detection on the basic template information and the enhanced template information to obtain log detection results.
[0081] This application also provides an electronic device 70, please refer to... Figure 7 It includes a memory 701 and a processor 702, wherein the memory 701 is used to store computer programs; and the processor 702 is used to execute the programs stored in the memory 701 to implement the log detection method described in any embodiment of this application.
[0082] In one embodiment, this application provides a vehicle including the aforementioned electronic device 70.
[0083] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the log detection method described in any embodiment of this application.
[0084] In this application, "multiple" refers to two or more.
[0085] The terms “first,” “second,” “third,” “fourth,” etc., used in this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.
[0086] In this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, in this application, the character " / " generally indicates that the preceding and following related objects have an "or" relationship.
[0087] Unless otherwise specified, all steps in this application may be performed sequentially or randomly. For example, if the method includes steps A and B, it means that the method may include steps A and B performed sequentially, or it may include steps B and A performed sequentially. For example, if the method may also include step C, it means that step C may be added to the method in any order. For example, the method may include steps A, B, and C, or it may include steps A, C, and B, or it may include steps C, A, and B, etc.
[0088] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the protection scope of this application.
Claims
1. A log detection method, characterized in that, include: Key parameters are filtered out from the original logs and added to the original logs to obtain enhanced logs; Log parsing is performed on the original log and the enhanced log to obtain basic template information corresponding to the original log and enhanced template information corresponding to the enhanced log; Anomaly detection is performed on the basic template information and the enhanced template information to obtain log detection results.
2. The log detection method as described in claim 1, characterized in that, The process of filtering key parameters from the original log and adding the key parameters to the original log to obtain enhanced logs includes: Parameter values exceeding a preset parameter threshold are filtered out from the original logs, and the parameter values and the parameter names corresponding to the parameter values are identified as key parameters; The key parameters are added to the original log as append fields to obtain the enhanced log.
3. The log detection method as described in claim 1, characterized in that, The step of parsing the original log and the enhanced log to obtain basic template information corresponding to the original log and enhanced template information corresponding to the enhanced log includes: The original log is processed to obtain an original log template, and the basic template information is determined based on the original log template. The enhanced log is processed to obtain an enhanced log template, and the enhanced template information is determined based on the enhanced log template.
4. The log detection method as described in claim 1, characterized in that, The step of performing anomaly detection on the basic template information and the enhanced template information to obtain log detection results includes: The original identifier information in the basic template information and the enhanced identifier information in the enhanced template information are vectorized to obtain an identifier sequence; The original parameter values in the basic template information and the enhanced parameter values in the enhanced template information are vectorized to obtain a parameter sequence. Determine the log feature vector based on the identifier sequence and the parameter sequence; Anomaly detection is performed on the log feature vector to obtain the log detection results.
5. The log detection method as described in claim 4, characterized in that, The step of performing anomaly detection on the log feature vector to obtain log detection results includes: The log feature vector is input into the log detection model; the log detection model includes a long short-term memory network for detecting identifier sequences and a convolutional neural network for detecting parameter sequences; The Long Short-Term Memory network is used to perform anomaly detection on the identifier sequence to obtain the identifier detection result; The parameter sequence is subjected to anomaly detection using the convolutional neural network to obtain parameter detection results; The log detection result is determined based on the identifier detection result and the parameter detection result.
6. The log detection method as described in claim 5, characterized in that, The step of determining the log detection result based on the identifier detection result and the parameter detection result includes: The identifier detection result and the parameter detection result are weighted to obtain the log detection score; When the log detection score exceeds a preset anomaly threshold, a log detection result representing an anomaly in the original log is obtained; When the log detection score does not exceed the preset anomaly threshold, a log detection result indicating that the original log is normal is obtained.
7. A log detection device, characterized in that, include: The log enhancement module is used to filter out key parameters from the original log and add the key parameters to the original log to obtain enhanced log; The log parsing module is used to parse the original log and the enhanced log to obtain basic template information corresponding to the original log and enhanced template information corresponding to the enhanced log. The detection result module is used to perform anomaly detection on the basic template information and the enhanced template information to obtain log detection results.
8. An electronic device, characterized in that, Including processor and memory, among which, Memory, used to store computer programs; A processor is used to execute a program stored in memory to implement the log detection method according to any one of claims 1 to 6.
9. A vehicle, characterized in that, Including the electronic device as described in claim 8.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the log detection method according to any one of claims 1 to 6.