A log anomaly detection method based on multi-agent generated critical collaboration

Abstract

This invention discloses a log anomaly detection method based on multi-agent generative critical collaboration. The method includes: constructing a local retrieval-enhanced generative knowledge base storing source domain log text templates and high-dimensional semantic vectors; receiving real-time heterogeneous logs from the target domain and calculating similarity scores, executing a dual-track routing mechanism; if the score is higher than a threshold, retrieving known features; otherwise, triggering a semantic alignment agent to generate initial semantic vectors; calculating distribution divergence through a domain-adaptive agent and feeding it back, iteratively updating the vectors through multiple rounds of generative critical game until convergence; aggregating features to construct a real-time time series sequence and calculating the distribution deviation relative to the globally optimal normal baseline, outputting an alarm signal. This invention, through multi-agent collaboration and generative critical mechanisms, solves the problems of fragmented feature extraction and detection, high computational cost of large models, and insufficient robustness of cross-domain alignment in cross-system log detection, achieving low-latency, high-precision zero-sample cross-domain anomaly detection.

Description

Technical Field

[0001] This invention belongs to the field of intelligent operation and maintenance and artificial intelligence application technology, specifically involving a log anomaly detection method based on multi-agent generation and critical collaboration. It is particularly suitable for solving the performance degradation problem of anomaly detection models caused by log format heterogeneity and data distribution offset in cross-system or cross-dataset scenarios. Background Technology

[0002] Log anomaly detection, a core technology in intelligent operations and maintenance, aims to identify abnormal states and potential faults in system operation by automatically monitoring and analyzing semi-structured logs generated by distributed systems. With the widespread adoption of cloud computing and microservice architectures, system scale is increasingly large, making log anomaly detection with cross-system generalization capabilities crucial for ensuring system stability and availability. Traditional log anomaly detection methods mainly include rule-based matching and statistical sequence-based methods. Rule-based matching methods typically extract fixed log templates by manually designing regular expressions or frequency thresholds. These methods heavily rely on expert experience, struggle to handle system iterations and changing log formats, and have poor generalization capabilities. Statistical sequence-based methods convert logs into template index sequences and utilize Markov models, clustering algorithms, etc., for behavioral baseline modeling. These methods are also limited by predefined templates. When applied to new systems with different architectures and business logic (i.e., target domains), the model performance significantly degrades due to the large differences in log vocabulary and structure—i.e., data distribution shifts.

[0003] In recent years, methods based on deep learning and large language models have been introduced into this field to leverage their powerful semantic understanding capabilities. Existing technologies include segmented feature mapping detection schemes, employing a unidirectional pipeline architecture of "parse-align-detection," first extracting log templates and aligning feature spaces, then performing anomaly detection. However, in these schemes, the feature alignment and detection modules are isolated; if a deviation occurs in the feature mapping, subsequent modules cannot perform reverse error correction, leading to error accumulation. Another approach is based on full-scale prompt word inference using large models, directly inputting all logs into a large language model and performing online anomaly inference using carefully designed prompt words. This method performs full-scale inference on all logs, including a large number of high-frequency, patterned regular logs, resulting in extremely high computational costs and inference latency, failing to meet the timeliness requirements of industrial-grade real-time alerts. Furthermore, standard contrastive representation transfer schemes utilize anomaly labels from the source domain to constrain the feature space of the target domain through contrastive learning, achieving inter-domain alignment. However, these methods typically focus only on extreme samples with significant differences, lack the ability to perceive and correct subtle feature shifts, and their one-way static feature mapping mechanism lacks dynamic interactive feedback, making it difficult to establish accurate and robust normal baselines in unlabeled target domains.

[0004] In summary, existing technologies for cross-system log anomaly detection generally suffer from the problems of fragmented feature extraction and anomaly detection modules and a lack of collaborative error correction capabilities. Existing technologies typically employ a unidirectional pipeline architecture, where the feature extraction module is unaware of the needs of downstream detection tasks. When faced with unknown heterogeneous logs, if ambiguous deviations occur in feature extraction, the detection module cannot provide effective feedback and correction, leading to increased false positives and false negatives. Furthermore, solutions incorporating large language models often employ a full-scale inference mode, failing to distinguish between high-frequency regular logs and low-frequency heterogeneous logs. This indiscriminate computing power scheduling mechanism results in severe waste of computing resources, high inference latency, and difficulty in implementation in industrial scenarios with massive log concurrency. In addition, existing domain adaptation techniques largely rely on static, unidirectional feature mapping, lacking dynamic interactive feedback mechanisms. This makes it difficult to effectively handle subtle feature fluctuations caused by minor data shifts, and hinders the achievement of high-precision cross-domain baseline consensus through adversarial learning in the absence of target domain anomaly labels, limiting the model's zero-shot generalization ability.

[0005] Therefore, how to overcome model degradation and computational redundancy caused by data heterogeneity in cross-dataset log anomaly detection is one of the technical problems that urgently need to be solved by those skilled in the art. Summary of the Invention

[0006] The main objective of this invention is to overcome the shortcomings and deficiencies of existing technologies and provide a log anomaly detection method based on multi-agent generative critical collaboration. This invention achieves deep collaboration between large language model intent parsing and cross-domain feature alignment through an innovative dual-track routing mechanism and multi-agent game architecture design. Thus, even when the target system lacks anomaly labels and there is significant data heterogeneity, it can achieve high-quality, zero-sample cross-system log anomaly detection with low computing power cost.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] This invention provides a log anomaly detection method based on multi-agent generation and critical collaboration, comprising the following steps:

[0009] S1. Construct a local retrieval-enhanced generation knowledge base, wherein the knowledge base stores source domain log text templates and their corresponding high-dimensional semantic vectors;

[0010] S2. Receive real-time heterogeneous logs from the target domain and calculate the similarity score between the real-time heterogeneous logs and the log text templates in the local retrieval enhancement knowledge base; based on the comparison result of the similarity score and a preset matching threshold, execute a dual-track routing mechanism:

[0011] If the similarity score is greater than the preset matching threshold, the real-time heterogeneous log is determined to be a known normal mode or an aligned mode log. Then, a high-dimensional semantic vector matching the real-time heterogeneous log is retrieved from the local retrieval enhancement generation knowledge base as a known feature.

[0012] If the similarity score is less than or equal to the preset matching threshold, the real-time heterogeneous log is determined to be an unknown cross-domain heterogeneous outlier log. Then, the semantic alignment agent is triggered to extract the deep business intent of the real-time heterogeneous log using the large language model built into the semantic alignment agent, and generate an initial semantic vector. The deep business intent includes business operation type semantics, system running status semantics, and operation execution result semantics.

[0013] S3. Calculate the distribution divergence between the initial semantic vector and the normal baseline of the source domain in the shared space through the domain adaptive agent, and feed the distribution divergence as an error signal back to the semantic alignment agent, so as to iteratively update the initial semantic vector through multiple rounds of generation critical game until the distribution divergence converges, and output the aligned semantic vector.

[0014] S4. By aggregating the known features or the aligned semantic vectors through the anomaly detection agent, a real-time time-series feature sequence of the target domain is constructed, and the distribution deviation of the real-time time-series feature sequence relative to the global optimal normal baseline is calculated; when the distribution deviation exceeds the judgment threshold, a cross-system log anomaly detection alarm signal is output.

[0015] As a preferred technical solution, in step S1, a local retrieval-enhanced knowledge base is constructed, specifically as follows:

[0016] In the offline phase, log text with normal labels from the source domain is used to parse heterogeneous raw log text into a unified log text template through a log parsing algorithm. The log text template is then input into a large language model. Preset prompts guide the large language model to ignore non-semantic characters and focus on extracting the deep business intent represented by the log. A high-dimensional semantic vector set is constructed by embedding model encoding and stored in a local retrieval enhancement generation knowledge base. The entry format of the knowledge base is "log text template - high-dimensional semantic vector" key-value pairs.

[0017] As a preferred technical solution, in step S2, if the similarity score is less than or equal to the preset matching threshold, the current discrimination is suspended, and the large language model built into the semantic alignment agent is activated. The large language model removes system-specific parameters from the log based on preset context prompts, extracts deep business intents that are not related to the domain, and generates an initial source domain baseline semantic vector.

[0018] As a preferred technical solution, step S3, which involves calculating the distribution divergence between the initial semantic vector and the source domain normal baseline in the shared space using a domain adaptive agent, includes:

[0019] The maximum mean difference is used to measure the divergence of the distribution of the target domain features and the normal baseline of the source domain in the reproducing kernel Hilbert space. :

[0020]

[0021] in, Represents the target domain feature set With source domain normal baseline set Distribution divergence in the shared space; Represents the source domain feature set The first in Each feature sample Represents the feature mapping function. Represents the regenerated nucleus Hilbert space Norms in and These represent the number of feature samples in the source domain and the target domain, respectively. Represents the target domain feature set The first in A feature sample.

[0022] As a preferred technical solution, the source domain normal baseline is constructed by retrieving the high-dimensional semantic direction corresponding to all normal logs of the source domain from the local retrieval enhancement generation knowledge base.

[0023] As a preferred technical solution, in step S3, the initial semantic vector is iteratively updated through multiple rounds of critical game generation, specifically as follows:

[0024] The domain-adaptive agent will calculate the distribution divergence. The critique error signal is fed back to the semantic alignment agent. Upon receiving this feedback, the semantic alignment agent adaptively adjusts the feature extraction weights of the large language model or updates the prompt word parameters, and regenerates the target domain features. The two parties perform this multi-round "generation-critique" feature alignment game, and the optimization objective is to minimize ,when When the value drops below the convergence threshold, the game converges, indicating that the two parties have successfully aligned the heterogeneous logs of the target domain to the optimal normal baseline of the source domain through critical collaboration, achieving cross-domain baseline consensus, and outputting the final aligned semantic vector. .

[0025] As a preferred technical solution, in step S3, after the game convergence, the domain-adaptive agent will reach a consensus on the heterogeneous logs. and its corresponding optimal alignment vector As new key-value pairs, they are written in reverse to the front-end local retrieval enhancement generated knowledge base.

[0026] As a preferred technical solution, in step S4, the real-time time-series feature sequence of the target domain is constructed, specifically as follows:

[0027] The known features from the retrieval hit links and the aligned features output after game convergence are fused together and reassembled by timestamp into a real-time time-series feature sequence of the target system.

[0028] As a preferred technical solution, step S4, the step of calculating the distribution deviation of the real-time time-series feature sequence relative to the globally optimal normal baseline, includes:

[0029] The deviation of the real-time time-series feature sequence from the globally optimal normal baseline is quantified using Mahalanobis distance or density-based local anomaly factor, and the calculation formula is as follows:

[0030]

[0031] in, Indicates time Real-time feature vectors The degree of deviation from the globally optimal normal baseline; Represents real-time time series feature sequences Mid-moment eigenvectors; and These represent the mean vector and the inverse of the covariance matrix of the globally optimal normal baseline features in the alignment space, respectively.

[0032] As a preferred technical solution, in step S4, the semantic alignment agent and the domain adaptive agent are trained collaboratively through a joint optimization objective, which is composed of a weighted sum of source domain feature reconstruction loss and cross-domain distribution divergence loss.

[0033] Compared with existing technologies, this invention demonstrates significant advantages in cross-system log anomaly detection, particularly in reducing the computational overhead of large models, overcoming data distribution offset in unlabeled target domains, and automating system operation and maintenance. These advantages are all attributed to the unique technical methods employed in this invention. Compared with existing cross-domain log detection and large model log analysis technologies, this invention has the following significant advantages, each achieved through different innovative technical means:

[0034] (1) Significantly reduce the computational overhead of large language models and improve real-time detection efficiency: This invention solves the problems of computational redundancy and high latency caused by introducing large language models from the bottom layer of the architecture by constructing a dual-track feature routing and diversion mechanism based on a local knowledge base. This advantage lies in the use of a different technical means than the existing full-scale inference model. A similarity retrieval link is introduced in the pre-stage, and the massive and high-frequency known pattern regular logs are directly output as features through low-cost vector matching, while the high-energy-consuming large language model inference is strictly limited to a very small number of heterogeneous outlier logs that do not hit the retrieval rules. This "on-demand scheduling" technical means realizes the precise allocation of computing resources, enabling the system to maintain extremely high real-time early warning efficiency in industrial-grade high-concurrency scenarios.

[0035] (2) Significantly enhances the model's robustness and zero-shot generalization ability in the face of cross-system data shifts: This invention breaks through the bottleneck of the traditional detection model's precipitous drop in accuracy during cross-system migration by constructing a multi-agent generative critical feedback architecture. This advantage lies in the adoption of deep interaction and dynamic error correction techniques, abandoning the existing one-way static feature mapping strategy, and using a domain adaptive agent to calculate the distribution divergence between the initial features of the target domain and the baseline of the source domain in real time, and then passing this divergence back to the semantic alignment agent as a critical error. This technique based on multi-round adversarial game forces the model to continuously adaptively calibrate the feature extraction strategy in an environment without abnormal labels in the target domain until a consensus on the optimal baseline across domains is reached, thereby alleviating the misalignment of the underlying semantic space of heterogeneous logs.

[0036] (3) Achieving automated evolution of system-level cross-domain knowledge and zero manual rule maintenance: This invention enables the detection system to continuously optimize over time through a closed-loop self-evolution strategy. This advantage is due to the use of a feature consensus dynamic write-back technique: when the multi-agent game converges and cross-domain baseline alignment is achieved, the system automatically updates the newly extracted heterogeneous log parsing rules and optimal semantic vectors to the front-end local knowledge base. This technique transforms unknown logs that originally consumed a lot of model computing power into known logs that can be directly retrieved, reducing the extremely tedious manual regular expression writing and offline rule base maintenance work in traditional methods, and improving the automation level of the system's long-term operation. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1This is a flowchart of a log anomaly detection method based on multi-agent generation and critical collaboration, according to an embodiment of the present invention.

[0039] Figure 2 This is a flowchart of the dual-track routing mechanism according to an embodiment of the present invention;

[0040] Figure 3 This is a flowchart illustrating the multi-agent generation of critical feedback and domain-adaptive alignment in an embodiment of the present invention.

[0041] Figure 4 This is a flowchart illustrating the detection process of an anomaly detection agent in an embodiment of the present invention. Detailed Implementation

[0042] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative effort are within the scope of protection of the present application.

[0043] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application can be combined with other embodiments.

[0044] This embodiment provides a log anomaly detection method based on multi-agent generative critical collaboration. By integrating a local retrieval-augmented generation (RAG) knowledge base with a semantic alignment agent, the system can prioritize low-cost vector matching in the knowledge base, diverting logs with known patterns to the retrieval bypass. Only when encountering unknown heterogeneous logs that do not match the rules is the large language model triggered to extract their deep business intent, thereby significantly reducing the overall inference cost of the system while ensuring cross-domain semantic parsing capabilities. Figure 1 As shown, the log anomaly detection method based on multi-agent generation and critical collaboration specifically includes the following steps:

[0045] S1. Construct a local retrieval-enhanced knowledge base;

[0046] Specifically, in the offline phase, preprocessing is performed using log text with normal tags from the source system (source domain, such as BGL). This includes log parsing and template extraction. The heterogeneous raw log text is parsed into a unified log text template using a log parsing algorithm, removing variable parameters and retaining the fixed text template content. The log text template is then input into a large language model. Preset prompts guide the model to ignore non-semantic characters and focus on extracting the deep business intent represented by the logs, such as underlying system operation behaviors and business states. A high-dimensional semantic vector set is constructed by embedding model encoding and stored in a local retrieval-enhanced knowledge base. The knowledge base entries are formatted as "log text template - high-dimensional semantic vector" key-value pairs. The deep business intent includes business operation type semantics, system running status semantics, and operation execution result semantics.

[0047] S2. Receive real-time heterogeneous logs from the target domain and calculate the similarity score between the real-time heterogeneous logs and the log text templates in the local retrieval enhancement knowledge base; based on the comparison result of the similarity score and the preset matching threshold, execute a dual-track routing mechanism.

[0048] Specifically, such as Figure 2 As shown, in the online real-time detection phase, the real-time heterogeneous logs input to the target system (target domain, such as HDFS) are... The system first preprocesses the text, including removing useless special characters, word segmentation, and normalization. Then, a lightweight text encoder is used to convert it into query vectors, mapping the log text to a vector representation, thus providing a foundation for subsequent similarity retrieval. The generated query feature vectors are then... The input is used to enhance the knowledge base generated from local retrieval, and then cosine similarity retrieval is performed. The retrieval process calculates the input log features and their comparison with known log anchors in the knowledge base. The corresponding high-dimensional feature vector Perform cosine similarity matching calculation to obtain the Top-K similarity score. :

[0049]

[0050] Based on similarity score Triggering the dual-track traffic splitting mechanism:

[0051] 1) Retrieval of the hit link: If the highest similarity Greater than the preset matching threshold The system determines whether the log belongs to a known normal mode or an aligned mode. The semantic alignment agent directly retrieves the corresponding fixed high-dimensional semantic vector from the knowledge base. The data is then output to the post-detection module. This process completely bypasses large model inference, greatly saving computational resources.

[0052] 2) Adaptive link generation: If the highest similarity Less than or equal to the threshold The log is identified as an unknown, cross-domain, heterogeneous outlier. At this point, the system automatically suspends the current judgment and activates the large language model built into the semantic alignment agent. Based on preset contextual clues, the large model removes log entries... The system-specific parameters (such as specific IP, timestamp, process ID) are used to extract the domain-independent deep business intent and generate an initial source domain baseline semantic vector. The process is represented as:

[0053]

[0054] in This refers to the context of prompt words that guide the removal of specific parameters from large language models.

[0055] S3. Calculate the distribution divergence between the initial semantic vector and the normal baseline of the source domain in the shared space through the domain adaptive agent, and feed the distribution divergence as an error signal back to the semantic alignment agent, so as to iteratively update the initial semantic vector through multiple rounds of generation critical game until the distribution divergence converges, and output the aligned semantic vector.

[0056] Specifically, such as Figure 3 As shown, in step S3, this step is only triggered for the initial semantic vector output by the "adaptive generation link," aiming to solve the feature distribution shift problem in the case of no abnormal labels in the target domain. The domain adaptive agent, acting as the "critic," first retrieves the high-dimensional semantic vectors corresponding to all normal logs in the source domain from the local enhanced generation knowledge base, constructing a normal baseline feature set for the source domain. (represented in the figure) Simultaneously, it receives real-time data from the semantic alignment agent's "generator" based on the initialized semantic vector. (represented in the figure) The target domain feature set generated in round t) (represented in the figure) The agent uses the maximum mean difference to measure the divergence of the distribution of target domain features and the normal baseline of the source domain in the reproducing kernel Hilbert space. (represented in the figure) ):

[0057]

[0058] in, Represents the target domain feature set With source domain normal baseline set Distribution divergence in the shared space; Represents the source domain feature set The first in Each feature sample Represents the feature mapping function. Represents the regenerated nucleus Hilbert space Norms in and These represent the number of feature samples in the source domain and the target domain, respectively. Represents the target domain feature set The first in A feature sample.

[0059] Interactive feedback and iterative reconstruction: The domain-adaptive agent calculates the distribution divergence. The error signal is fed back to the semantic alignment agent. Upon receiving this feedback, the semantic alignment agent adaptively adjusts the feature extraction weights of the large language model or updates the prompt word parameters, regenerating the target domain features. Both parties then proceed in rounds... This multi-round feature alignment game of "generate-critique-optimize" is executed internally, and its optimization objective is to minimize .when Decrease to convergence threshold When the game reaches convergence, the system considers that the two parties have successfully aligned the heterogeneous logs of the target domain to the optimal normal baseline of the source domain through critical collaboration, achieving cross-domain baseline consensus, and outputting the final aligned semantic vector. .

[0060] Knowledge base dynamic self-evolution: After game convergence, the domain-adaptive agent synchronously triggers the knowledge base dynamic self-evolution mechanism, integrating heterogeneous logs that have reached consensus. and its corresponding optimal alignment vector As a new key-value pair, it is written in reverse to the front-end local retrieval enhancement generation knowledge base, so that when similar cross-domain logs appear in the future, they can be directly hit by low-cost retrieval bypass, realizing the automatic evolution of the system and the subsequent step-by-step reduction of computing power overhead.

[0061] S4. By aggregating the known features or the aligned semantic vectors through an anomaly detection agent, a real-time temporal feature sequence of the target domain is constructed, and the distribution deviation of the real-time temporal feature sequence relative to the globally optimal normal baseline is calculated. For example... Figure 4 As shown, step S4 serves as the output end of the entire monitoring system, strictly implementing the functions of overall data aggregation and real-time discrimination.

[0062] Integrated Data Integration: The anomaly detection agent receives feature data from the dual-track routing system in real time. Specifically, it seamlessly integrates known features from the retrieval hit links. And the alignment features output after game convergence. And reassemble them according to timestamps into a real-time time-series feature sequence of the target system. ,in Indicates at time The converged feature vectors. Based on the globally optimal normal baseline reconstructed after the convergence of the multi-agent game, the anomaly detection agent calculates the real-time sequence. The feature vector at the current time step The deviation from the baseline is the distribution distance. In this embodiment, Mahalanobis distance or density-based local anomaly factor is used to quantify the deviation. :

[0063]

[0064] in, Indicates time Real-time feature vectors The degree of deviation from the globally optimal normal baseline; Represents real-time time series feature sequences Mid-moment eigenvectors; and These represent the mean vector and the inverse of the covariance matrix of the globally optimal normal baseline features in the alignment space, respectively.

[0065] Anomaly detection and output: The system dynamically maintains a detection threshold. When the calculated deviation of the real-time feature sequence exceeds this threshold multiple times consecutively, i.e. When the anomaly detection agent triggers a hard decision, it outputs a cross-system log anomaly detection alarm signal and records the high-dimensional feature context that caused the anomaly for subsequent tracing. Furthermore, to ensure successful convergence of semantic alignment and domain adaptation multi-agent collaboration, this invention designs a global joint optimization objective. Its loss is derived from source domain feature reconstruction. Cross-domain distribution divergence loss Weighted composition:

[0066]

[0067] in, This is used to ensure that the source domain features extracted by the large language model can accurately represent the underlying business logic of normal logs. It is a hyperparameter that balances the cross-domain alignment strength. and Let represent the feature sets of the source and target domains, respectively. The objective is to optimize the global joint optimization. This technical solution not only preserves the discriminative structural information of the source system logs, but also forcibly narrows the feature distribution of the heterogeneous target system logs.

[0068] Through the above technical solutions, this invention achieves full-process automation, from dual-track computing power distribution in the knowledge base and multi-agent interaction alignment of heterogeneous logs to online time-series deviation warning. This method abandons the independent, unidirectional feature mapping pipeline in traditional cross-domain detection, and endows the system with powerful zero-sample generalization capability and rule-free maintenance characteristics through a closed-loop feedback of "generation-critique-optimization," laying a solid technical foundation for the intelligent operation and maintenance of large-scale, multi-source heterogeneous distributed clusters.

[0069] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0070] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. A log anomaly detection method based on multi-agent generative critical collaboration, characterized in that, Includes the following steps: S1. Construct a local retrieval-enhanced generation knowledge base, wherein the knowledge base stores source domain log text templates and their corresponding high-dimensional semantic vectors; S2. Receive real-time heterogeneous logs from the target domain and calculate the similarity score between the real-time heterogeneous logs and the log text templates in the local retrieval enhancement knowledge base. Based on the comparison result between the similarity score and the preset matching threshold, a dual-track routing mechanism is executed: If the similarity score is greater than the preset matching threshold, the real-time heterogeneous log is determined to be a known normal mode or an aligned mode log. Then, a high-dimensional semantic vector matching the real-time heterogeneous log is retrieved from the local retrieval enhancement generation knowledge base as a known feature. If the similarity score is less than or equal to the preset matching threshold, the real-time heterogeneous log is determined to be an unknown cross-domain heterogeneous outlier log. Then, the semantic alignment agent is triggered to extract the deep business intent of the real-time heterogeneous log using the large language model built into the semantic alignment agent, and generate an initial semantic vector. The deep business intent includes business operation type semantics, system running status semantics, and operation execution result semantics. S3. Calculate the distribution divergence between the initial semantic vector and the normal baseline of the source domain in the shared space through the domain adaptive agent, and feed the distribution divergence as an error signal back to the semantic alignment agent, so as to iteratively update the initial semantic vector through multiple rounds of generation critical game until the distribution divergence converges, and output the aligned semantic vector. S4. By aggregating the known features or the aligned semantic vectors through the anomaly detection agent, a real-time time-series feature sequence of the target domain is constructed, and the distribution deviation of the real-time time-series feature sequence relative to the global optimal normal baseline is calculated; when the distribution deviation exceeds the judgment threshold, a cross-system log anomaly detection alarm signal is output.

2. The log anomaly detection method based on multi-agent generation and critical collaboration as described in claim 1, characterized in that, In step S1, a local retrieval-enhanced knowledge base is constructed, specifically as follows: In the offline phase, log text with normal tags from the source domain is used to parse heterogeneous raw log text into a unified log text template through a log parsing algorithm. The log text template is then input into a large language model. Preset prompt words guide the large language model to ignore non-semantic characters and focus on extracting the deep business intent represented by the log. A high-dimensional semantic vector set is constructed by embedding model encoding and stored in a local retrieval enhancement generation knowledge base. The entry format of the knowledge base is "log text template - high-dimensional semantic vector" key-value pairs.

3. The log anomaly detection method based on multi-agent generation and critical collaboration as described in claim 1, characterized in that, In step S2, if the similarity score is less than or equal to the preset matching threshold, the current discrimination is suspended, and the built-in large language model of the semantic alignment agent is activated. The large language model removes system-specific parameters from the log based on preset context prompts, extracts deep business intents that are not related to the domain, and generates an initial source domain baseline semantic vector.

4. The log anomaly detection method based on multi-agent generation and critical collaboration as described in claim 1, characterized in that, In step S3, the step of calculating the distribution divergence between the initial semantic vector and the normal baseline of the source domain in the shared space through the domain adaptive agent includes: The maximum mean difference is used to measure the divergence of the distribution of target domain features and the normal baseline of the source domain in the reproducing kernel Hilbert space. : in, Represents the target domain feature set With source domain normal baseline set Distribution divergence in the shared space; Represents the source domain feature set The first in Each feature sample Represents the feature mapping function. Represents the regenerated nucleus Hilbert space Norms in and These represent the number of feature samples in the source domain and the target domain, respectively. Represents the target domain feature set The first in A number of feature samples.

5. The log anomaly detection method based on multi-agent generation and critical collaboration according to claim 4, characterized in that, The source domain normal baseline is constructed by retrieving the high-dimensional semantic directions corresponding to all normal logs in the source domain from the local retrieval enhancement generation knowledge base.

6. The log anomaly detection method based on multi-agent generation and critical collaboration according to claim 4, characterized in that, In step S3, the initial semantic vector is iteratively updated through multiple rounds of critical game generation, specifically as follows: The domain-adaptive agent will calculate the distribution divergence. The critical error signal is fed back to the semantic alignment agent. After receiving the error feedback, the semantic alignment agent adaptively adjusts the feature extraction weights of the large language model or updates the prompt word parameters to regenerate the target domain features. Both sides engage in this multi-round feature alignment game of "generation-critique," with the optimization objective being to minimize... ,when When the value drops below the convergence threshold, the game converges, indicating that the two parties have successfully aligned the heterogeneous logs of the target domain to the optimal normal baseline of the source domain through critical collaboration, achieving cross-domain baseline consensus, and outputting the final aligned semantic vector. .

7. The log anomaly detection method based on multi-agent generation and critical collaboration according to claim 1, characterized in that, In step S3, after the game convergence, the domain-adaptive agent will reach a consensus on the heterogeneous logs. and its corresponding optimal alignment vector As new key-value pairs, they are written in reverse to the front-end local retrieval enhancement generated knowledge base.

8. The log anomaly detection method based on multi-agent generation and critical collaboration according to claim 1, characterized in that, In step S4, the real-time time-series feature sequence of the target domain is constructed, specifically as follows: The known features from the retrieval hit links and the aligned features output after game convergence are fused together and reassembled by timestamp into a real-time time-series feature sequence of the target system.

9. The log anomaly detection method based on multi-agent generation and critical collaboration according to claim 1, characterized in that, Step S4, the step of calculating the distribution deviation of the real-time time-series feature sequence relative to the globally optimal normal baseline, includes: The deviation of the real-time time-series feature sequence from the globally optimal normal baseline is quantified using Mahalanobis distance or density-based local anomaly factor, and the calculation formula is as follows: in, Indicates time Real-time feature vectors The degree of deviation from the globally optimal normal baseline; Represents real-time time series feature sequences Mid-moment eigenvectors; and These represent the mean vector and the inverse of the covariance matrix of the globally optimal normal baseline features in the alignment space, respectively.

10. The log anomaly detection method based on multi-agent generation and critical collaboration according to claim 1, characterized in that, In step S4, the semantic alignment agent and the domain adaptive agent are trained collaboratively through a joint optimization objective, which is composed of a weighted sum of source domain feature reconstruction loss and cross-domain distribution divergence loss.

Images