Log anomaly detection system

Abstract

The application discloses a log anomaly detection system and relates to the technical field of anomaly detection.The application comprises a log graph construction and representation learning module, a global prototype aggregation module and a prototype alignment training and anomaly detection module.Original logs are parsed and divided according to sessions, each session is modeled as a directed weighted graph, semantic features and structural features of the graph are extracted and adaptively fused through a gating mechanism, session-level embedding representation is obtained through graph encoder updating and graph reading, local normal prototypes are calculated based on normal session embedding, local normal prototypes uploaded by each client are aggregated on the server side, a global normal prototype is generated by optimizing the cosine distance, attraction loss and repulsion loss are respectively applied to normal and abnormal session embedding to align the global prototype, and the cosine distance between the embedding of a session to be detected and the global prototype is calculated as an anomaly score during reasoning to determine the anomaly.The application effectively alleviates the representation drift caused by heterogeneous data distribution, and improves the detection stability and communication efficiency.

Description

Technical Field

[0001] This invention relates to the field of anomaly detection technology, specifically a log anomaly detection system. Background Technology

[0002] With the rapid development of cloud computing, the Internet of Things, edge computing, and distributed systems, various systems continuously generate a large amount of log data during operation. Log data records system state changes, task execution processes, error messages, and user access behavior, serving as crucial evidence for detecting system failures, attacks, and operational anomalies. However, in practical applications, logs from different servers, devices, or business systems are typically scattered across different clients or organizations. Limited by factors such as data privacy, security compliance, and communication costs, raw log data is often difficult to centrally aggregate for unified modeling.

[0003] Meanwhile, significant differences exist in system environment, log templates, runtime load, and anomaly types among different clients, resulting in log data exhibiting significant non-independent and identically distributed characteristics. Traditional centralized log anomaly detection methods and ordinary federated learning parameter aggregation methods are prone to problems such as inconsistent feature representations, unstable detection boundaries, and decreased anomaly recognition performance in this scenario. Therefore, this invention proposes a federated learning-based log anomaly detection method to address the issues of the inability to share log data among multiple clients under privacy constraints, heterogeneous data distribution across clients, and the difficulty in fully modeling log semantic and structural dependencies. Summary of the Invention

[0004] The purpose of this invention is to provide a log anomaly detection system that solves the problems existing in the background art.

[0005] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: The present invention provides a log anomaly detection system, including a log graph construction and representation learning module, a global prototype aggregation module, and a prototype alignment training and anomaly detection module.

[0006] The log graph construction and representation learning module parses the original logs and divides them into sessions. Based on the parsing results, each session is modeled as a directed weighted graph. The semantic and structural features of the directed weighted graph are extracted, and the initial representation is obtained through adaptive fusion using a gating mechanism. The initial representation is updated through a graph encoder, and the session-level embedding representation is obtained through graph reading. The local normal prototype is calculated based on the embedding representation of normal log sessions. The global prototype aggregation module is used to receive local normal prototypes uploaded by each client, introduce a global prototype network to aggregate the local normal prototypes, generate a global normal prototype by optimizing the cosine distance between each local normal prototype and the global normal prototype, and then distribute the global normal prototype to each client. The prototype alignment training and anomaly detection module is used to apply an attraction loss to normal session embeddings based on the global normal prototype and a repulsion loss to known anomalous session embeddings during local training. During the inference phase, the cosine distance between the embedding representation of the log session to be detected and the global normal prototype is calculated as the anomaly score, and the log to be detected is judged and analyzed based on the anomaly score.

[0007] The beneficial effects of this invention are as follows: (1) This invention adopts a client-server federated architecture. Each client retains local log data and trains the log representation model only locally. The server does not access the original logs or participate in the training of client model parameters. Instead, it receives low-dimensional local normal prototypes uploaded by each client, aggregates them, generates a global normal prototype, and then distributes it to each client. Under the premise of ensuring that the original log data and model parameters do not leave the local area, cross-client knowledge sharing and collaborative modeling are realized, which effectively solves the problem that log data cannot be centrally shared due to privacy compliance, security requirements and other factors.

[0008] (2) This invention maps normal logs from heterogeneous client environments to the vicinity of the same global normal prototype through a prototype-driven federated representation alignment mechanism, effectively alleviating the representation drift problem caused by differences in system environment, log template, and runtime load among different clients. At the same time, the local Loggr model models the log session as a graph structure, integrates the semantic and structural features of log events, and captures the contextual dependencies between events through a relation-aware graph encoder, making the local representation more discriminative. Attached Figure Description

[0009] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0010] Figure 1 This is a schematic diagram of the system structure connection of the present invention.

[0011] Figure 2 This is an overview diagram of the Loggr-FedPB system of the present invention.

[0012] Figure 3 This is a comparison chart of anomaly detection performance under the independent and identically distributed case of the HDFS dataset in this invention.

[0013] Figure 4 This is a comparison chart of anomaly detection performance under the independent and identically distributed BGL dataset of this invention.

[0014] Figure 5 This is a performance comparison chart of log anomaly detection in the HDFS dataset of the present invention, showing a non-independent and identically distributed label skew scenario.

[0015] Figure 6 This is a performance comparison chart of log anomaly detection for non-independent and identically distributed label skew scenes using the BGL dataset of this invention.

[0016] Figure 7 This is a performance comparison chart of log anomaly detection in a scenario with skewed numbers in the non-independent and identically distributed HDFS dataset, as presented in this invention.

[0017] Figure 8 This is a performance comparison chart of log anomaly detection for non-independent and identically distributed skewed BGL datasets in this invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Reference Figure 1 and 2 As shown, the present invention provides a log anomaly detection system, including a log graph construction and representation learning module, a global prototype aggregation module, and a prototype alignment training and anomaly detection module.

[0020] The log graph construction and representation learning module parses the original logs and divides them into sessions. Based on the parsing results, each session is modeled as a directed weighted graph. The semantic and structural features of the directed weighted graph are extracted, and the initial representation is obtained through adaptive fusion using a gating mechanism. The initial representation is updated through a graph encoder, and the session-level embedding representation is obtained through graph reading. The local normal prototype is calculated based on the embedding representation of normal log sessions. In the above embodiments, the specific method for parsing the original logs and dividing them by session, and modeling each session as a directed weighted graph based on the parsing results, is as follows: The log parser performs structured processing on the raw logs, mapping log messages into templates. Each log template corresponds to a log event. For log data containing explicit identifiers, log entries belonging to the same session are merged into one session based on the identifier. For log data lacking unique identifiers, a sliding window is set to divide the raw log sequence into multiple subsequences based on the sliding window. Each subsequence is a session, and any raw log uniquely belongs to a specific session. After completing the session partitioning, a directed weighted graph is constructed based on each session, denoted as . ,in, This represents the set of log event types that occur in the session. Each type of event is represented by a unique log event ID and corresponds to a node in the graph. Let be a set of directed edges. Representing an edge The frequency of occurrence in the current session, the semantic attributes of a node are determined by the node feature matrix. This means that each log session graph is associated with a feature matrix, with each row corresponding to an event type. The initial semantic vectors of the local log dataset are represented as a graph set. ,in The log events are labeled as nodes in the graph, the transition relationships between adjacent events in the event sequence are used as directed edges, and the frequency of each edge in the current session is used as the weight of the edge.

[0021] It should be noted that the construction method of the directed weighted graph transforms each log session into a structured representation that can simultaneously retain event type information and the transition relationship between events. The edge weights adopt the transition frequency so that the graph structure can reflect the difference in transition intensity between log events. The node feature matrix retains the textual semantic information of log events, providing initial feature input for subsequent gating fusion and relation-aware encoding.

[0022] For session partitioning strategies, identifier-based partitioning is suitable for system logs with explicit job or request identifiers, such as block identifiers in a distributed file system, while sliding window-based partitioning is suitable for general system logs that lack such identifiers. Both strategies ensure that each original log uniquely belongs to a session, thereby ensuring the consistency and reproducibility of graph modeling.

[0023] In the above embodiments, the extraction of semantic and structural features of the directed weighted graph, and the adaptive fusion through a gating mechanism to obtain an initial representation, are specifically achieved as follows: For each node in the directed weighted graph, the corresponding initial semantic vector is encoded through a linear transformation, as shown in the following formula: ,in The projection matrix is ​​learnable. For bias vectors, This indicates the dimension of the hidden representation within the model. The semantic embedding of the node in the model space is mapped to the hidden layer space of the model to obtain the semantic embedding of the node; Extract the in-degree of each node ) and out-degree Each layer maps the in-degree and out-degree values ​​to dense vectors using a separate embedding layer. The concatenated vectors are then linearly projected to generate a structural embedding with the same dimension as the semantic embedding. The corresponding formula is: ,in This represents a vector concatenation operation. The concatenated degree features are projected onto the same dimension as the semantic vector. .

[0024] Semantic embeddings and structural embeddings are concatenated, and the structural injection coefficients are calculated through a fully connected layer with a sigmoid activation function. The corresponding formula is: ,in, Let be the bias vector in the gated network. The semantic embedding and the structural embedding are weighted and summed using the structural injection coefficients as weights to obtain the initial representation of the node. The corresponding formula is: .

[0025] It's important to note that the importance of semantic and structural information in log events varies across different anomaly detection scenarios. For example, for anomalies where content strongly depends on semantics, semantic features play a dominant role; while for logical infinite loops or control flow anomalies, the structural role of nodes in the graph changes more critically. Taking a log session graph containing six log event nodes e1 to e6 as an example, in a normal session, event e3 typically acts as a hub node in the execution flow, connecting multiple subsequent operations and forming paths e1→e2→e3→e4→e5 and e1→e2→e3→e6. In this case, node e3 has a high in-degree and out-degree. When an anomaly occurs, although the semantic content of event e3 remains unchanged, the execution flow may terminate prematurely at e3, forming only the path e1→e2→e3. In this case, the out-degree of node e3 decreases significantly, making it a terminal node. Therefore, relying solely on semantic features is insufficient to effectively identify such anomalies; it is necessary to supplement them with node in-degree and out-degree as structural features. The gating mechanism dynamically adjusts the fusion ratio of semantic features and structural features through structural injection coefficients, enabling the model to adaptively balance the contributions of the two according to different log scenarios, avoiding representation bias caused by fixed weighting or simple concatenation.

[0026] In the above embodiments, the specific method for updating the initial representation through a graph encoder, obtaining a session-level embedded representation through graph readout, and calculating a local normal prototype based on the embedded representation of a normal log session is as follows: The initial representation is input into a multi-layer graph encoder based on the Transformer framework. In each layer, the occurrence intensity of a node in the directed weighted graph is obtained, where the occurrence intensity is specifically the sum of the edge weights of all adjacent edges of the node. The key vector and value vector are scaled using the occurrence intensity, with the corresponding formula as follows: ,in It is a node The query vector, It is a node The key vector, It is a node The value vector, To represent the node occurrence intensity, LN denotes layer normalization. Layer normalization is applied to the query vector, key vector, and value vector, and the corresponding query, key, and value matrices are obtained through linear projection, denoted as […]. ; The relation location encoding is defined based on the shortest path distance between nodes. When calculating the attention score between nodes, the interaction terms between the query vector and the relation location encoding, as well as the interaction terms between the key vector and the relation location encoding, are included in the attention score. The attention weight is obtained through Softmax, and the corresponding formula is as follows: ,in For nodes and The shortest path distance between them For two sets of learnable relation embeddings, For nodes and Relationship perception attention score For nodes and Attention weights between them; During the value aggregation phase, the attention weights are weighted and summed with the value vectors, and then grouped with the relation embedding term based on the shortest path distance between nodes. The result is added to the aggregation result of the corresponding attention weight to obtain the first... The nodes output by the layer are represented as follows: ,in For structural distance; The node representations output from the last layer of the graph encoder are aggregated using the graph read function to obtain a graph-level representation of the log session graph, as shown in the formula: ,in Represents a node go through The final node representation obtained after learning layer-relationship perception representation. This represents the set of nodes in the log session graph. The graph readout function, based on the embedded representation set of normal log sessions on the client's local machine, performs statistical aggregation on the session embeddings to obtain a local normal prototype, as shown in the formula: ,in This represents a set of normal log session representations.

[0027] It should be noted that the graph encoder introduces relationship awareness and intensity scaling strategies on top of the standard Transformer, enabling the structural dependencies between events in the log session graph to be explicitly integrated into the node representation update process. The standard Transformer performs global aggregation based on the semantic similarity of node content, which can easily overlook the actual topological relationships that exist between events in the log session.

[0028] The key and value vectors are scaled by the node occurrence strength, i.e., the sum of edge weights, so that key nodes with high transition frequency in the control flow have a greater influence in information transmission. Simultaneously, relational position encoding based on the shortest path distance between nodes is introduced into two stages: attention computation and value aggregation, forming a dual-channel information fusion path. The former aggregates semantic content through attention weights, while the latter aggregates corresponding spatial priors based on structural distance. This allows the model to simultaneously perceive semantic associations and topological distances between events, thereby generating a contextualized representation robust to changes in log control flow. The graph readout function aggregates the final representations of all nodes in the graph into a fixed-dimensional graph-level representation, which serves as the unified input for subsequent federated prototype alignment and anomaly detection. The local normal prototype is obtained by averaging the graph-level representations of all normal log sessions on the client, and is used to transmit statistical information about local normal behavior patterns to the server.

[0029] The global prototype aggregation module is used to receive local normal prototypes uploaded by each client, introduce a global prototype network to aggregate the local normal prototypes, generate a global normal prototype by optimizing the cosine distance between each local normal prototype and the global normal prototype, and then distribute the global normal prototype to each client. In the above embodiments, the specific method for receiving the local normal prototypes uploaded by each client and introducing a global prototype network to aggregate the local normal prototypes is as follows: The server receives local normal prototypes uploaded by each client, uses each received local normal prototype as an observation of the distribution of normal behavior, and introduces a global prototype network to aggregate the local normal prototypes, so that the global normal prototype is located at the center of all local normal prototypes.

[0030] It should be noted that in federated learning scenarios, the data distribution of each client often exhibits non-independent and identically distributed characteristics. The local normal prototypes uploaded by different clients may have significant shifts in the feature space. If a simple weighted average is used for aggregation, the global prototype may be dominated by clients with a large number of samples or more extreme distributions, failing to accurately reflect the common normal behavior patterns across clients. Therefore, a global prototype network is introduced, treating the local normal prototypes uploaded by each client as observation samples of the normal behavior distribution. The prototype distribution is modeled through learnable network parameters, thereby finding a global reference representation located at the center of all local normal prototypes.

[0031] In the above embodiment, the specific method for generating a global normal prototype by optimizing the cosine distance between each local normal prototype and the global normal prototype, and then distributing the global normal prototype to each client, is as follows: Using the sum of the cosine distances between each local normal prototype and the global normal prototype as the loss function, the global prototype network is optimized using the stochastic gradient descent algorithm to obtain the updated global normal prototype. The corresponding formula is: ,in, As the baseline for normal global behavior, These are the trainable parameters for LPN, which stands for Global Prototype Network, and distributes the updated global normal prototype to each client.

[0032] It's important to note that the optimization process uses cosine distance because the local normal prototypes from different clients in a federated learning scenario may have significant differences in vector magnitude. Cosine distance effectively eliminates the influence of magnitude, more accurately measuring the directional consistency between prototypes, and allowing the global prototype to focus more on the directional features of normal behavior patterns rather than their amplitude features. In each round of federated communication, the server uses the local normal prototypes uploaded by each client as observations of the normal behavior distribution. With the goal of minimizing the sum of the cosine distances between each local normal prototype and the global normal prototype, the parameters of the global prototype network are updated using stochastic gradient descent, gradually causing the global normal prototype to converge towards the center of all local normal prototypes.

[0033] The optimization process guides the global prototype to align with the distribution of normal behavior observed by each client, thereby mitigating the prototype drift problem caused by client distribution differences in Non-IID scenarios. After optimization, the server distributes the updated global normal prototype to each client. Each client, while retaining its local data and local model, uses this global normal prototype as a reference for normal behavior to perform the next round of local representation learning and prototype alignment.

[0034] The prototype alignment training and anomaly detection module is used to apply an attraction loss to normal session embeddings based on the global normal prototype and a repulsion loss to known anomalous session embeddings during local training. During the inference phase, the cosine distance between the embedding representation of the log session to be detected and the global normal prototype is calculated as the anomaly score, and the log to be detected is judged and analyzed based on the anomaly score.

[0035] In the above embodiments, the specific method for applying an attraction loss to normal session embeddings and a repulsion loss to known abnormal session embeddings during local training is as follows: For log session samples labeled as normal, the attraction loss is calculated with the objective of minimizing the cosine distance between the normal session embedding and the global normal prototype. The corresponding formula is: ,in Indicates cosine similarity; For a known abnormal log session, a boundary is set. When the cosine distance between the abnormal session embedding and the global normal prototype is less than the preset boundary, the repulsion loss is calculated, and the corresponding formula is: ,in The defined boundary; The weighted sum of the attraction loss, repulsion loss, and cross-entropy loss is given by the following formula: The total loss from local training is obtained, of which Let cross-entropy be the loss function. This is the regularization coefficient.

[0036] It's important to note that the core of the bidirectional geometric constraint mechanism lies in explicitly shaping the distribution structure of normal and abnormal behaviors in the feature space through a global normal prototype. The attraction loss aims to bring the embedding representations of all normal log sessions closer to the global normal prototype, ensuring that even with differences in data distribution across different clients, their normal behavior patterns converge towards the same global anchor point in the feature space, thus maintaining consistency with the global benchmark locally. The repulsion loss introduces a preset boundary as a safety margin between normal and abnormal behavior. This term is activated only when the cosine distance between the embedding representation of an abnormal sample and the global normal prototype is less than τ, penalizing abnormal representations that intrude into the safety margin and forcing them away from the global normal prototype. This conditional activation design prevents already sufficiently displaced abnormal samples from being pushed further away meaninglessly, making the training process more stable.

[0037] By jointly optimizing the attraction loss, repulsion loss and cross-entropy loss, the local model retains its ability to distinguish known abnormal patterns while gradually shaping the distribution of normal behavior in the embedding space into a compact region centered on the global normal prototype, pushing the distribution of abnormal behavior outside this region, so that the training objective and the subsequent distance-based anomaly judgment criteria remain strictly consistent.

[0038] In the above embodiments, during the inference phase, the cosine distance between the embedded representation of the log session to be detected and the global normal prototype is calculated as an anomaly score, and the log to be detected is judged and analyzed based on the anomaly score. The specific method is as follows: The input graph encoder of the log to be detected is used for forward inference to obtain a session-level embedding representation. The cosine distance between this embedding representation and the global normal prototype is calculated as the anomaly score, and the corresponding formula is: ,in For any log session to be detected, the set boundary is used as the judgment threshold. When the abnormal score is greater than the threshold, the session is judged as abnormal; otherwise, it is judged as normal.

[0039] It should be noted that the anomaly detection mechanism uniformly models anomaly detection as a geometric deviation problem between the log graph representation and the global normal prototype. During the training phase, the distribution structure of normal and abnormal behaviors in the embedding space has been explicitly shaped through attraction loss and repulsion loss. That is, normal samples are compressed into a compact region centered on the global normal prototype, while abnormal samples are pushed away from the center. Therefore, during the inference phase, there is no need to rely on independent classifiers or complex post-processing steps. The cosine distance can be used directly to effectively measure the degree to which the detected session deviates from the normal behavior pattern.

[0040] The judgment threshold directly reuses the preset boundary τ defined during the training phase, ensuring consistency between the training objective and the detection standard and avoiding the problem of inconsistency between training and inference objectives. The entire anomaly scoring and judgment process is completed locally on the client side. The server only maintains and updates the global normal prototype without participating in specific detection decisions. This allows each client to independently complete anomaly detection tasks while sharing the global normal behavior benchmark, achieving consistent anomaly judgment across systems while protecting data privacy.

[0041] It should be noted that: reference Figure 3 and 4As shown, for example, the federated learning system contains 10 clients. In each round of communication, all clients participate in training and model updates. The global federated training rounds are set to 100 rounds. Each client performs 3 training rounds locally and then uploads a local normal prototype to the server. During training, the batch size is uniformly set to 64, and the prototype vector dimension is uniformly set to 2048. The local Loggr model training uses the AdamW optimizer. After each round of aggregation, the server updates the global prototype network using SGD. Each round of aggregation is trained for 1000 epochs to fully fit the prototype distribution uploaded by the clients and generate a stable global prototype representation. The regularization coefficient λ is set to 1. The normal prototype distributions of different datasets differ, and the preset boundary τ needs to be set according to the characteristics of the dataset. For example, for the HDFS dataset, τ can be set to 1, and for the BGL dataset, τ can be set to 0.6.

[0042] NeuralLog-avg, LogRobust-avg, and DRLLog-avg were selected as baselines for comparison. All three were implemented using the FedAvg strategy for federated processing, meaning each client uploaded complete model parameters, which were then weighted and averaged by the server before being distributed. In the IID federated setup, the training set was evenly divided into 10 non-overlapping subsets and distributed to each client. Each client had the same amount of data and approximately consistent label distribution. The test set was also evenly distributed among the clients for local evaluation. Experimental results show that on the HDFS dataset, Loggr-FedPB achieves the best performance with Recall=1.000 and F1-score=0.982, which is about 2.0% better than the best baseline method DRLLog-avg. The Recall is about 3.3% better than NeuralLog-avg (0.968), which maintains stable false alarm control while significantly reducing false negatives. On the BGL dataset, Loggr-FedPB has a Precision of 0.959, a Recall of 0.972, and an F1-score of 0.966, which is about 2.7% better than DRLLog-avg (F1-score=0.941). While the Recall is improved by about 4.6%, the Precision does not decrease significantly, which verifies that the prototype alignment-based federated learning strategy can stably improve the anomaly detection performance in the IID scenario.

[0043] It should be noted that: reference Figure 5 and 6As shown, DRLLog is an unsupervised log anomaly detection method. Its training process relies solely on normal samples to model the system behavior distribution without explicitly utilizing anomaly labels. In the Non-IID scenario, each client exhibits skewed label distribution and data volume. Since the unsupervised method only uses local normal samples for training, it is difficult to guarantee the consistency of training data partitioning and modeling assumptions across clients. Therefore, this embodiment does not report the results of DRLLog-avg. In the label distribution skew setting, each client has the same number of training samples, but the ratio of normal to anomaly samples differs significantly. Using Dirichlet distribution to model the label allocation between different clients makes it difficult to align the discrimination boundaries learned by each client, thus placing higher demands on the robustness of the federated aggregation strategy. Experimental results show that on the HDFS dataset, Loggr-FedPB significantly improves overall detection performance, with an F1-score improvement of approximately 10.5% compared to the best baseline method. This is mainly due to its improved coverage of anomalous samples while maintaining high detection accuracy. It effectively alleviates the false negative problem caused by client bias and maintains stable false positive control even under severely uneven label distribution. On the BGL dataset, Loggr-FedPB also achieves the best overall detection performance, with an F1-score improvement of approximately 6.8% compared to the best baseline method. While some comparative methods can achieve high detection accuracy under this setting, their recall rate drops significantly, resulting in limited overall performance. Loggr-FedPB, on the other hand, maintains a more balanced trade-off between precision and recall, exhibiting stronger robustness under label skew conditions.

[0044] It should be noted that: reference Figure 7 and 8As shown, in the quantity skew setting, the number of training samples for each client is no longer consistent. The sample size is unevenly distributed among clients through the Dirichlet distribution. This setting introduces quantity heterogeneity and inevitably leads to label distribution skew, constituting a more challenging Non-IID setting. Experimental results show that on the HDFS dataset, quantity skew has a particularly significant impact on the comparison methods, resulting in a significant decrease in their overall detection performance. However, Loggr-FedPB maintains stable detection performance in this scenario, with an overall F1-score significantly better than the comparison methods. This indicates that by aggregating and aligning at the prototype level, the dominant client effect introduced by sample size imbalance can be effectively mitigated, allowing local patterns from different clients to participate in global modeling in a more balanced manner. On the BGL dataset, quantity skew also causes a significant imbalance between precision and recall in some baseline methods, especially manifested as a sharp decrease in recall, thus limiting overall detection performance. Loggr-FedPB, however, can maintain a relatively stable precision-recall tradeoff under quantity skew conditions and achieves the best overall F1-score, further verifying its robustness in complex Non-IID scenarios.

[0045] The above content is merely an example and illustration of the concept of the present invention. Those skilled in the art can make various modifications or additions to the specific embodiments described, or use similar methods to replace them, as long as they do not deviate from the concept of the invention or exceed the scope defined by the present invention, and all such modifications and additions should fall within the protection scope of the present invention.

Claims

1. A log anomaly detection system, characterized in that, include: The log graph construction and representation learning module parses the original logs and divides them into sessions. Based on the parsing results, each session is modeled as a directed weighted graph. The semantic and structural features of the directed weighted graph are extracted, and the initial representation is obtained through adaptive fusion using a gating mechanism. The initial representation is updated through a graph encoder, and the session-level embedding representation is obtained through graph reading. The local normal prototype is calculated based on the embedding representation of normal log sessions. The global prototype aggregation module is used to receive local normal prototypes uploaded by each client, introduce a global prototype network to aggregate the local normal prototypes, generate a global normal prototype by optimizing the cosine distance between each local normal prototype and the global normal prototype, and then distribute the global normal prototype to each client. The prototype alignment training and anomaly detection module is used to apply an attraction loss to normal session embeddings based on the global normal prototype and a repulsion loss to known anomalous session embeddings during local training. During the inference phase, the cosine distance between the embedding representation of the log session to be detected and the global normal prototype is calculated as the anomaly score, and the log to be detected is judged and analyzed based on the anomaly score.

2. The log anomaly detection system according to claim 1, characterized in that, The specific method for parsing the original logs and dividing them by session, and then modeling each session as a directed weighted graph based on the parsing results, is as follows: The log parser performs structured processing on the raw logs, mapping log messages into templates. Each log template corresponds to a log event. For log data containing explicit identifiers, log entries belonging to the same session are merged into one session based on the identifier. For log data lacking unique identifiers, a sliding window is set to divide the raw log sequence into multiple subsequences based on the sliding window. Each subsequence is a session, and any raw log uniquely belongs to a specific session. After completing the session partitioning, a directed weighted graph is constructed based on each session, denoted as . ,in, This represents the set of log event types that occur in the session. Each type of event is represented by a unique log event ID and corresponds to a node in the graph. Let be a set of directed edges. Representing an edge The frequency of occurrence in the current session, the semantic attributes of a node are determined by the node feature matrix. This means that each log session graph is associated with a feature matrix, with each row corresponding to an event type. The initial semantic vectors of the local log dataset are represented as a graph set. ,in The log events are labeled as nodes in the graph, the transition relationships between adjacent events in the event sequence are used as directed edges, and the frequency of each edge in the current session is used as the weight of the edge.

3. The log anomaly detection system according to claim 2, characterized in that, The semantic and structural features of the extracted directed weighted graph are adaptively fused using a gating mechanism to obtain an initial representation. The specific method is as follows: For each node in the directed weighted graph, the corresponding initial semantic vector is encoded through a linear transformation, as shown in the following formula: ,in The projection matrix is ​​learnable. For bias vectors, This represents the dimension of the hidden representation within the model. The semantic embedding of the node in the model space is mapped to the hidden layer space of the model to obtain the semantic embedding of the node; Extract the in-degree of each node ) and out-degree Each layer maps the in-degree and out-degree values ​​to dense vectors using a separate embedding layer. The concatenated vectors are then linearly projected to generate a structural embedding with the same dimension as the semantic embedding. The corresponding formula is: ,in This represents a vector concatenation operation. The concatenated degree features are projected onto the same dimension as the semantic vector. ; Semantic embeddings and structural embeddings are concatenated, and the structural injection coefficients are calculated through a fully connected layer with a sigmoid activation function. The corresponding formula is: ,in, Let be the bias vector in the gated network. The semantic embedding and the structural embedding are weighted and summed using the structural injection coefficients as weights to obtain the initial representation of the node. The corresponding formula is: .

4. The log anomaly detection system according to claim 3, characterized in that, The method for updating the initial representation through a graph encoder, obtaining a session-level embedded representation through graph readout, and calculating a local normal prototype based on the embedded representation of a normal log session is as follows: The initial representation is input into a multi-layer graph encoder based on the Transformer framework. In each layer, the occurrence intensity of a node in the directed weighted graph is obtained, where the occurrence intensity is specifically the sum of the edge weights of all adjacent edges of the node. The key vector and value vector are scaled using the occurrence intensity, with the corresponding formula as follows: ,in It is a node The query vector, It is a node The key vector, It is a node The value vector, To represent the node occurrence intensity, LN denotes layer normalization. Layer normalization is applied to the query vector, key vector, and value vector, and the corresponding query, key, and value matrices are obtained through linear projection, denoted as […]. ; The relation location encoding is defined based on the shortest path distance between nodes. When calculating the attention score between nodes, the interaction terms between the query vector and the relation location encoding, as well as the interaction terms between the key vector and the relation location encoding, are included in the attention score. The attention weight is obtained through Softmax, and the corresponding formula is as follows: ,in For nodes and The shortest path distance between them For two sets of learnable relation embeddings, For nodes and Relationship perception attention score For nodes and Attention weights between them; During the value aggregation phase, the attention weights are weighted and summed with the value vectors, and then grouped with the relation embedding term based on the shortest path distance between nodes. The result is added to the aggregation result of the corresponding attention weight to obtain the first... The nodes output by the layer are represented as follows: ,in For structural distance; The node representations output from the last layer of the graph encoder are aggregated using the graph read function to obtain a graph-level representation of the log session graph, as shown in the formula: ,in Represents a node go through The final node representation obtained after learning layer-relationship perception representation. This represents the set of nodes in the log session graph. The graph readout function, based on the embedded representation set of normal log sessions on the client's local machine, performs statistical aggregation on the session embeddings to obtain a local normal prototype, as shown in the formula: ,in This represents a set of normal log session representations.

5. The log anomaly detection system according to claim 1, characterized in that, The method for receiving local normal prototypes uploaded by each client and aggregating them using a global prototype network is as follows: The server receives local normal prototypes uploaded by each client, uses each received local normal prototype as an observation of the distribution of normal behavior, and introduces a global prototype network to aggregate the local normal prototypes, so that the global normal prototype is located at the center of all local normal prototypes.

6. The log anomaly detection system according to claim 5, characterized in that, The method for generating a global normal prototype by optimizing the cosine distance between each local normal prototype and the global normal prototype, and then distributing the global normal prototype to each client, is as follows: Using the sum of the cosine distances between each local normal prototype and the global normal prototype as the loss function, the global prototype network is optimized using the stochastic gradient descent algorithm to obtain the updated global normal prototype. The corresponding formula is: ,in, As the baseline for normal global behavior, These are the trainable parameters for LPN, which stands for Global Prototype Network, and distributes the updated global normal prototype to each client.

7. The log anomaly detection system according to claim 1, characterized in that, During local training, an attraction loss is applied to normal session embeddings based on a global normal prototype, while a repulsion loss is applied to known abnormal session embeddings. The specific method is as follows: For log session samples labeled as normal, the attraction loss is calculated with the objective of minimizing the cosine distance between the normal session embedding and the global normal prototype. The corresponding formula is: ,in Indicates cosine similarity; For a known abnormal log session, a boundary is set. When the cosine distance between the abnormal session embedding and the global normal prototype is less than the preset boundary, the repulsion loss is calculated, and the corresponding formula is: ,in The defined boundary; The weighted sum of the attraction loss, repulsion loss, and cross-entropy loss is given by the following formula: The total loss from local training is obtained, of which Let cross-entropy be the loss function. This is the regularization coefficient.

8. The log anomaly detection system according to claim 7, characterized in that, During the inference phase, the cosine distance between the embedded representation of the log session to be detected and the global normal prototype is calculated as an anomaly score. The log to be detected is then analyzed based on the anomaly score. The specific method is as follows: The input graph encoder of the log to be detected is used for forward inference to obtain a session-level embedding representation. The cosine distance between this embedding representation and the global normal prototype is calculated as the anomaly score, and the corresponding formula is: ,in For any log session to be detected, the set boundary is used as the judgment threshold. When the abnormal score is greater than the threshold, the session is judged as abnormal; otherwise, it is judged as normal.

Images