An information processing method, device, storage medium, and program product

Abstract

The application provides an information processing method, which comprises the following steps: receiving initial feature information of to-be-detected log information sent by a terminal; wherein the to-be-detected log information is log information of a to-be-detected data processor; determining first feature information of the initial feature information in a time dimension; determining second feature information of the initial feature information in a space dimension; determining an anomaly score for the to-be-detected log information based on the first feature information and the second feature information; and determining whether the to-be-detected log information is abnormal based on the anomaly score. The application solves the problems of insufficient modeling of spatial characteristics and insufficient modeling of time correlation, and improves the detection efficiency. The application also provides an information processing device, a storage medium and a program product.

Description

Technical Field

[0001] This application relates to information processing technology in the field of computer technology, and more particularly to an information processing method, device, storage medium and program product. Background Technology

[0002] In the data center and cloud computing fields, anomaly detection and real-time alerting of Data Processing Units (DPUs) are core technologies for ensuring the reliability of distributed systems. As the complexity of DPU functions increases, its log data exhibits characteristics such as high dimensionality, multimodality, and nonlinear mutations. Therefore, existing detection methods suffer from insufficient spatial characteristic modeling and inadequate temporal correlation modeling, resulting in poor detection efficiency. Summary of the Invention

[0003] This application provides an information processing method, device, storage medium, and program product, which solves the problems of insufficient spatial characteristic modeling and inadequate temporal correlation modeling in related technologies, and greatly improves detection efficiency.

[0004] The technical solution of this application embodiment is implemented as follows: An information processing method, applied to a server, comprising: The receiving terminal sends initial feature information of the log information to be detected; wherein, the log information to be detected is log information for the data processor to be detected; Determine the first feature information of the initial feature information in the time dimension; Determine the second feature information of the initial feature information in the spatial dimension; An anomaly score is determined for the log information to be detected based on the first feature information and the second feature information; The anomaly score is used to determine whether the log information to be detected is abnormal.

[0005] In the above scheme, determining the first feature information of the initial feature information in the time dimension includes: First temporal feature information is determined from the initial feature information to characterize the features of the first duration; Determine second temporal feature information for characterizing the second duration from the initial feature information; wherein the second duration is greater than the first duration; The first feature information is obtained by fusing the first time feature information and the second time feature information.

[0006] In the above scheme, the first temporal feature information used to characterize the first duration for determining the initial feature information includes: The first temporal feature information is obtained by extracting features from the initial feature information using a target convolutional gated recurrent network. Accordingly, the second temporal feature information used to characterize the second duration for determining the initial feature information includes: The second temporal feature information is obtained by using a first target temporal convolutional network to extract features from the initial feature information.

[0007] In the above scheme, determining the second feature information of the initial feature information in the spatial dimension includes: Construct a target matrix based on the target's physical distribution information and target's logical distribution information; The initial feature information and the target matrix are processed using a target multi-head dynamic attention network to obtain the feature information to be processed; Static feature extraction and dynamic feature extraction are performed on the feature information to be processed to obtain first spatial feature information and second spatial feature information, respectively; The second feature information is obtained by fusing the first spatial feature information and the second spatial feature information.

[0008] In the above scheme, the step of performing static feature extraction and dynamic feature extraction on the feature information to be processed to obtain first spatial feature information and second spatial feature information includes: The first spatial feature information is obtained by using a target convolutional network to extract features from the feature information to be processed. The target multi-head dynamic attention network is used to extract features from the feature information to be processed to obtain the second spatial feature information.

[0009] In the above scheme, determining the anomaly score for the log information to be detected based on the first feature information and the second feature information includes: The first feature information and the second feature information are fused to obtain fused feature information; An anomaly score is determined for the log information to be detected based on the fused feature information.

[0010] An information processing method, applied to a terminal, includes: Obtain the detection log information of the data processor to be detected, and process the detection log information; A second-target temporal convolutional network is used to extract features from the processed log information to be detected to obtain initial feature information; The initial feature information is sent to the server so that the server can determine whether the log information to be detected is abnormal based on the first feature information in the time dimension and the second feature information in the spatial dimension determined by the initial feature information.

[0011] A first information processing apparatus, the apparatus comprising: A receiving unit is used to receive initial feature information of the log information to be detected sent by the terminal; wherein the log information to be detected is log information for the data processor to be detected; The first determining unit is used to determine the first feature information of the initial feature information in the time dimension; The second determining unit is used to determine the second feature information of the initial feature information in the spatial dimension; The first processing unit is configured to determine an anomaly score for the log information to be detected based on the first feature information and the second feature information. The first processing unit is further configured to determine whether the log information to be detected is abnormal based on the anomaly score.

[0012] A second information processing apparatus, the apparatus comprising: The acquisition unit is used to acquire the detection log information of the data processor to be detected and to process the detection log information. The second processing unit is used to extract initial feature information from the processed log information to be detected using a second target temporal convolutional network. The sending unit is used to send the initial feature information to the server, so that the server can determine whether the log information to be detected is abnormal based on the first feature information in the time dimension and the second feature information in the spatial dimension determined by the initial feature information.

[0013] An information processing device, the information processing device comprising: a processor, a memory, and a communication bus; The communication bus is used to realize the communication connection between the processor and the memory; The processor is used to execute the information processing program in the memory to implement the steps of the above-described information processing method.

[0014] A computer-readable storage medium storing one or more programs that can be executed by one or more processors to implement the steps of the information processing method described above.

[0015] A computer program product comprising a computer program that, when executed by a processor, implements the aforementioned information processing method.

[0016] The information processing method, device, storage medium, and program product provided in this application embodiment can receive initial feature information of log information to be tested for a data processor to be tested sent by a terminal, determine first feature information of the initial feature information in the time dimension, and determine second feature information of the initial feature information in the spatial dimension, determine an anomaly score for the log information to be tested based on the first and second feature information, and determine whether the log information to be tested is abnormal based on the anomaly score. In this way, the server can determine the feature information in the time dimension and the feature information in the spatial dimension based on the initial feature information of the log information to be tested sent by the terminal, and jointly determine the anomaly score of the log information to be tested based on the feature information in the time dimension and the feature information in the spatial dimension, thereby determining whether the log information of the data processor to be tested is abnormal based on the anomaly score. This solves the problems of insufficient spatial characteristic modeling and insufficient temporal correlation modeling in the detection schemes of related technologies, and greatly improves the detection efficiency. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating an information processing method provided in an embodiment of this application; Figure 2 This is a flowchart illustrating another information processing method provided in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of a first information processing device provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of a second information processing device provided in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of a server provided in an embodiment of this application; Figure 6 This is a schematic diagram of the structure of a terminal provided in an embodiment of this application. Detailed Implementation

[0018] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0019] It should be understood that the phrases "embodiments of this application" or "foreign embodiments" throughout the specification mean that a specific feature, structure, or characteristic related to an embodiment is included in at least one embodiment of this application. Therefore, "embodiments of this application" or "in the foreign embodiments" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the various embodiments of this application, the sequence numbers of the above-described processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above-described embodiments are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0020] Unless otherwise specified, any step in the embodiments of this application performed by the electronic device may be executed by the processor of the electronic device. It is also worth noting that the embodiments of this application do not limit the order in which the electronic device performs the following steps. Furthermore, the methods used to process data in different embodiments may be the same or different methods. It should also be noted that any step in the embodiments of this application can be executed independently by the electronic device; that is, when the electronic device performs any step in the following embodiments, it may not depend on the execution of other steps.

[0021] It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of this application.

[0022] This application provides an information processing method that can be applied to a server. (Refer to...) Figure 1 As shown, the information processing method may include the following steps: Step 101: Receive the initial feature information of the log information to be detected sent by the terminal.

[0023] Among them, the log information to be detected is the log information of the data processor to be detected.

[0024] In this embodiment of the application, the method can be applied to an edge-cloud collaborative architecture; the server can refer to the cloud in the edge-cloud collaborative architecture; the terminal can refer to the edge in the edge-cloud collaborative architecture.

[0025] Specifically, the initial feature information can be obtained by extracting features from the log information of the data processor to be detected at the edge. The data processor to be detected can refer to the DPU that needs to be detected; the log information to be detected can refer to the log data of the DPU to be detected.

[0026] It should be noted that the log information to be tested can include various log data of the DPU to be tested; specifically, the log information to be tested can include Open vSwitch (OVS) log information, Storage Performance Development Kit (SPDK) log information, etc. In one feasible embodiment, the log data can include multi-dimensional system indicator data such as Central Processing Unit (CPU) utilization, disk utilization, memory utilization, and network traffic.

[0027] Step 102: Determine the first feature information of the initial feature information in the time dimension.

[0028] Specifically, feature extraction can be performed on the initial feature information in the time dimension to obtain the first feature information of the initial feature information in the time dimension.

[0029] It should be noted that the first feature information can be the feature information of the extracted initial feature information at different durations in the time dimension, and obtained after processing.

[0030] Step 103: Determine the second feature information of the initial feature information in the spatial dimension.

[0031] Specifically, feature extraction can be performed on the initial feature information in the spatial dimension to obtain the second feature information of the initial feature information in the spatial dimension.

[0032] It should be noted that the second feature information can be the feature information of the extracted initial feature information in different spatial dimensions, and obtained by processing it.

[0033] Step 104: Determine the anomaly score for the log information to be detected based on the first feature information and the second feature information.

[0034] Specifically, fused feature information can be determined based on the first feature information and the second feature information, and an anomaly score of the log information to be detected can be determined based on the fused feature information.

[0035] It should be noted that the anomaly score can be a score used to characterize the degree of anomaly in the log information of the DPU to be tested.

[0036] Step 105: Determine whether there are any anomalies in the log information to be detected based on the anomaly score.

[0037] Specifically, the cloud can compare the anomaly score obtained for the log information to be detected with an anomaly threshold, and determine whether there are any anomalies in the log information of the DPU to be detected based on the comparison result. If the anomaly score exceeds the anomaly threshold range, it is determined that the log information of the DPU to be detected is abnormal, thereby triggering a real-time alarm. In addition, root cause analysis will be automatically performed, providing a detailed anomaly report for rapid response and resolution of potential problems. It should be noted that the anomaly threshold can be dynamically set according to the specific scenario corresponding to the DPU to be detected.

[0038] Based on the foregoing embodiments, in other embodiments of this application, step 102 can be implemented in the following ways: A1. Determine the first time feature information used to characterize the features of the first duration.

[0039] The first duration can be a relatively short range of durations. In one feasible embodiment, the first duration can be a range of durations that can characterize local time features.

[0040] Specifically, the first time-duration features of the initial feature information can be extracted to obtain the first time-duration feature information; it should be noted that a convolutional gating network can be used in the cloud to process the initial feature information to obtain the first time-duration feature information.

[0041] A2. Determine the second time feature information used to characterize the features of the second duration from the initial feature information.

[0042] The second duration is longer than the first duration.

[0043] The second duration can be a relatively long periodic duration value. In one feasible embodiment, the second duration can be a duration range value that can characterize a long-term periodic pattern.

[0044] Specifically, the second time-duration features of the initial feature information can be extracted to obtain the second time-duration feature information; it should be noted that a convolutional network can be used in the cloud to process the initial feature information to obtain the second time-duration feature information.

[0045] A3. The first feature information is obtained by fusing the first time feature information and the second time feature information.

[0046] Specifically, the first feature information can be obtained by fusing the first time feature information and the second time feature information through the fusion module.

[0047] In other embodiments of this application, the first temporal feature information used to characterize the first duration for determining the initial feature information may include: The target convolutional gated recurrent network is used to extract features from the initial feature information to obtain the first-time feature information.

[0048] The target convolutional gated recurrent network may include a convolutional gated recurrent unit (ConvGRU) network, and the initial feature information may include the initial feature vector corresponding to the log data of the DPU to be detected; the first time feature information may include the first time feature vector.

[0049] Specifically, the initial feature vector can be used as input information and fed into the ConvGRU network, so that the ConvGRU network processes the initial feature vector to obtain the first-time feature vector.

[0050] It's important to note that the ConvGRU network extracts local features from the initial input feature vector through convolutional operations. Within each time step, ConvGRU processes local regions of the data using convolutional kernels, enabling it to capture spatial dependencies in DPU logs. In data center environments, log records from multiple DPUs exhibit significant spatial characteristics. ConvGRU effectively extracts these features, enhancing the understanding of anomalous behavior in DPU logs and thus improving detection accuracy. Furthermore, ConvGRU captures short-term temporal dependencies through its gating mechanism. It progressively processes the initial input feature vector over time and controls the flow of information and updates to memory units, effectively capturing the patterns of DPU load changes over time. This approach allows ConvGRU to better understand and predict the occurrence and development trends of anomalous behavior in DPU log anomaly detection. Moreover, it can handle multivariate data and adapt to real-time anomaly detection tasks requiring rapid response, ensuring the accuracy and timeliness of detection results.

[0051] In other embodiments of this application, the second time feature information used to characterize the second duration for determining the initial feature information may include: The first target temporal convolutional network is used to extract features from the initial feature information to obtain the second temporal feature information.

[0052] The first target temporal convolutional network may include a first temporal convolutional neural network (TCN); the second temporal feature information may include a second temporal feature vector.

[0053] Specifically, the initial feature vector can be used as input information and input into the first TCN network, so that the first TCN network processes the initial feature vector to obtain the second time feature vector.

[0054] It's important to note that TCN, through its unique convolutional structure, effectively captures long-term dependencies in time-series data, addressing the common problems of vanishing or exploding gradients. Specifically, TCN employs causal convolution, ensuring that convolutional operations only consider past time steps, thus preserving the temporal order of the data. This allows for more natural processing of sequential data, avoiding information leakage, and when predicting future loads, it relies solely on past observations, ensuring accurate modeling of temporal dependencies. Furthermore, TCN achieves effective modeling of long-term series through layer stacking and dilated convolution, making it particularly suitable for DPU log anomaly detection. Dilated convolution introduces holes between convolutional kernels, allowing TCN to expand its receptive field without increasing computational cost, thus covering longer time spans. This approach allows the model to maintain computational efficiency when handling long-term dependencies while avoiding information loss. TCN effectively captures and reflects long-period fluctuations and trend changes in DPU logs in its anomaly detection results. Moreover, TCN maintains high processing speed even with large-scale time-series data, making it ideal for real-time-critical DPU log anomaly detection tasks. Therefore, by leveraging TCN for long-term dependency modeling, the ability to capture long-term trends and periodic changes in multi-dimensional DPU log data can be effectively improved, enhancing the stability and accuracy of anomaly detection. It is particularly suitable for handling complex and dynamically changing workload patterns in data center environments, providing more robust and adaptive anomaly detection results.

[0055] In other embodiments of this application, step 103 described above can be implemented in the following ways: B1. Construct a target matrix based on the target's physical distribution information and target's logical distribution information.

[0056] The target matrix may include a dynamic adjacency matrix; the target physical distribution information may include physical topology information; and the target logical distribution information may include logical topology information.

[0057] Specifically, a dynamic adjacency matrix can be constructed based on physical and logical topology information; it should be noted that the logical topology information can include Kubernetes cluster distribution information. Furthermore, the dynamic adjacency matrix can be used to capture cross-node spatial competition relationships in real time. In one feasible embodiment, multi-dimensional spatial interaction patterns can be adaptively learned through a dynamic edge weight update mechanism (such as resource call frequency normalization).

[0058] B2. A target multi-head dynamic attention network is used to process the initial feature information and the target matrix to obtain the feature information to be processed.

[0059] The target multi-head dynamic attention network can include a multi-head dynamic graph attention mechanism (MDGAT) network.

[0060] Specifically, the MDGAT network can be used to process the initial feature vector, and the feature information to be processed can be determined based on the processing results and the obtained dynamic adjacency matrix.

[0061] B3. Static feature extraction and dynamic feature extraction are performed on the feature information to be processed to obtain the first spatial feature information and the second spatial feature information respectively.

[0062] Specifically, static features of the initial feature information can be extracted to obtain the first spatial feature information; it should be noted that a convolutional network can be used in the cloud to process the initial feature information to obtain the second spatial feature information.

[0063] In other embodiments of this application, dynamic features of the initial feature information can be extracted to obtain the second spatial feature information; it should be noted that the cloud can use an attention network to process the initial feature information to obtain the second spatial feature information.

[0064] B4. The first spatial feature information and the second spatial feature information are fused to obtain the second feature information.

[0065] Specifically, the cloud can use a cross-attention mechanism to fuse the first spatial feature information and the second spatial feature information to obtain the second feature information.

[0066] It should be noted that static and dynamic features can be combined to explicitly model the nonlinear coupling between variables. In one feasible embodiment, when network bandwidth utilization exceeds a threshold, the weight of CPU utilization is dynamically reduced through a cross-attention mechanism to prioritize critical tasks.

[0067] In other embodiments of this application, the above-mentioned static feature extraction and dynamic feature extraction of the feature information to be processed to obtain the first spatial feature information and the second spatial feature information may include: A target convolutional network is used to extract features from the feature information to be processed, thereby obtaining the first spatial feature information.

[0068] The target convolutional network may include a convolutional neural network (CNN); the first spatial feature information may include a first spatial feature vector.

[0069] Specifically, the initial feature vector can be used as input information and fed into a CNN network. The CNN network then processes the initial feature vector to obtain the first spatial feature vector. It should be noted that the CNN network can extract static spatial features (i.e., fixed topological features) such as server configuration and hardware specifications.

[0070] A target multi-head dynamic attention network is used to extract features from the feature information to be processed, thereby obtaining the second spatial feature information.

[0071] The second spatial feature information may include the second spatial feature vector.

[0072] Specifically, the initial feature vector can be used as input information and fed into the MDGAT network. The MDGAT network then processes the initial feature vector to obtain the second-space feature vector. It should be noted that the MDGAT network can be used to analyze dynamic metrics such as real-time request volume, network bandwidth, and CPU utilization. For example, the coupling relationship between network bandwidth and CPU utilization can be modeled as edge weights, and the competitive effect between the two can be explicitly captured through an attention mechanism.

[0073] It should be noted that this application uses the MDGAT network, which extracts multiple sets of feature vectors by employing multiple independent and parallel attention modules, and then concatenates these vectors.

[0074] In other embodiments of this application, step 104 described above can be implemented in the following ways: C1. The first feature information and the second feature information are fused to obtain the fused feature information.

[0075] Specifically, the first feature information and the second feature information can be fused together by the fusion module to obtain fused feature information; that is, the spatial feature information and the temporal feature information are fused together.

[0076] C2. Determine the anomaly score for the log information to be detected based on the fused feature information.

[0077] Specifically, the fused feature information can be analyzed, and anomaly scores can be determined for the log data of the DPU to be detected based on the analysis results.

[0078] It should be noted that by employing core technologies such as multi-head dynamic graph attention networks, spatiotemporal joint modeling, edge-cloud collaborative architecture, and DPU hardware acceleration, high accuracy, low latency, and low resource consumption in DPU log anomaly detection are achieved, solving the bottleneck problems of traditional methods in complex topology modeling, multivariate interactive analysis, and real-time performance assurance.

[0079] The information processing method provided in the embodiments of this application allows the server to determine the feature information in the time dimension and the feature information in the spatial dimension based on the initial feature information of the log information to be detected sent by the terminal side. The server then determines the anomaly score of the log information to be detected based on the feature information in the time dimension and the feature information in the spatial dimension. Based on the anomaly score, the server determines whether there is anomaly in the log information to be detected of the data processor to be detected. This solves the problems of insufficient spatial characteristic modeling and insufficient temporal correlation modeling in the detection schemes of related technologies, and greatly improves the detection efficiency.

[0080] Based on the foregoing embodiments, embodiments of this application provide an information processing method that can be applied to a terminal, as described above. Figure 2 As shown, the method may include the following steps: Step 201: Obtain the detection log information of the data processor to be tested, and process the detection log information.

[0081] Once the edge device obtains the log data from the DPU detection, it can preprocess the log data to improve data quality and the accuracy of the results.

[0082] Specifically, log data can be cleaned, normalized, feature selected and constructed, and processed using time-series data to obtain the processed log information to be detected. It should be noted that data cleaning includes handling missing values, outliers, noise, and duplicate data; data normalization can include Min-Max normalization, standardization, decimal scaling normalization, and MaxAbs normalization; feature selection and construction can include feature understanding and data exploration, feature selection, feature construction, feature verification, and optimization; and time-series data processing includes time-series data transformation and resampling, feature extraction and construction, time-series data stabilization, and trend and seasonality decomposition of time-series data.

[0083] Step 202: Use a second target temporal convolutional network to extract features from the processed log information to be detected to obtain initial feature information.

[0084] The second target temporal convolutional network may include a second TCN; the initial feature information may include an initial feature vector.

[0085] Specifically, the processed log information to be detected can be used as input information and fed into the second TCN. The second TCN performs feature extraction on the log information to be detected to obtain an initial feature vector.

[0086] Step 203: Send initial feature information to the server so that the server can determine whether there is any anomaly in the log information to be detected based on the first feature information in the time dimension and the second feature information in the spatial dimension determined by the initial feature information.

[0087] Specifically, after obtaining the initial feature vector at the edge, the edge can send the initial feature vector to the corresponding cloud. Then, the cloud can determine the first feature information in the time dimension and the second feature information in the spatial dimension of the initial feature vector, and determine the anomaly score for the log information to be detected based on the first feature information and the second feature information, and determine whether there is an anomaly in the log information to be detected based on the anomaly score.

[0088] It should be noted that the descriptions of the same or corresponding steps in this embodiment and other embodiments can be referred to the descriptions in other embodiments, and will not be repeated here.

[0089] The information processing method provided in the embodiments of this application involves a terminal determining the initial feature information of the log information to be detected for a data processor and then sending the initial feature information to a server. The server can then determine the feature information in the time dimension and the feature information in the spatial dimension based on the initial feature information sent by the terminal. Based on the feature information in the time dimension and the feature information in the spatial dimension, the server can jointly determine the anomaly score of the log information to be detected. Based on the anomaly score, the server can determine whether there is an anomaly in the log information to be detected for the data processor. This method solves the problems of insufficient spatial characteristic modeling and insufficient temporal correlation modeling in the detection schemes of related technologies, and greatly improves the detection efficiency.

[0090] Based on the foregoing embodiments, embodiments of this application provide a first information processing apparatus, which can be applied to... Figure 1 In the information processing method provided in the corresponding embodiment, refer to Figure 3 As shown, the first information processing device 3 may include: a receiving unit 31, a first determining unit 32, a second determining unit 33, and a first processing unit 34, wherein: The receiving unit 31 is used to receive the initial feature information of the log information to be detected sent by the terminal; wherein, the log information to be detected is the log information of the data processor to be detected; The first determining unit 32 is used to determine the first feature information of the initial feature information in the time dimension; The second determining unit 33 is used to determine the second feature information of the initial feature information in the spatial dimension; The first processing unit 34 is used to determine an anomaly score for the log information to be detected based on the first feature information and the second feature information. The first processing unit 34 is also used to determine whether there is an anomaly in the log information to be detected based on the anomaly score.

[0091] In other embodiments of this application, the first determining unit 32 is further configured to perform the following steps: First temporal feature information is determined to characterize the features of the first duration by identifying the initial feature information; Determine second temporal feature information for characterizing the second duration from the initial feature information; wherein the second duration is greater than the first duration; The first feature information is obtained by fusing the first time feature information and the second time feature information.

[0092] In other embodiments of this application, the first determining unit 32 is further configured to use a target convolutional gated recurrent network to extract features from the initial feature information to obtain first time-varying feature information.

[0093] In other embodiments of this application, the first determining unit 32 is further configured to use a first target temporal convolutional network to extract features from the initial feature information to obtain second temporal feature information.

[0094] In other embodiments of this application, the second determining unit 33 is further configured to perform the following steps: Construct a target matrix based on the target's physical distribution information and target's logical distribution information; A target multi-head dynamic attention network is used to process the initial feature information and the target matrix to obtain the feature information to be processed; Static feature extraction and dynamic feature extraction are performed on the feature information to be processed to obtain first spatial feature information and second spatial feature information respectively; The second feature information is obtained by fusing the first spatial feature information and the second spatial feature information.

[0095] In other embodiments of this application, the second determining unit 33 is further configured to perform the following steps: A target convolutional network is used to extract features from the feature information to be processed, thereby obtaining the first spatial feature information; A target multi-head dynamic attention network is used to extract features from the feature information to be processed, thereby obtaining the second spatial feature information.

[0096] In other embodiments of this application, the first processing unit 34 is further configured to perform the following steps: The first feature information and the second feature information are fused to obtain the fused feature information; Anomaly scores are determined for the log information to be detected based on fused feature information.

[0097] It should be noted that the specific implementation process of the steps performed by each unit in the embodiments of this application can be referred to Figure 1 The implementation process of the model determination method provided in the corresponding embodiment will not be described in detail here.

[0098] The first information processing device provided in the embodiments of this application allows the server to determine the feature information in the time dimension and the feature information in the spatial dimension based on the initial feature information of the log information to be detected sent by the terminal side, and to jointly determine the anomaly score of the log information to be detected based on the feature information in the time dimension and the feature information in the spatial dimension, thereby determining whether there is anomaly in the log information to be detected of the data processor to be detected based on the anomaly score. This solves the problems of insufficient spatial characteristic modeling and insufficient temporal correlation modeling in the detection schemes of related technologies, and greatly improves the detection efficiency.

[0099] Based on the foregoing embodiments, embodiments of this application provide a second information processing apparatus, which can be applied to... Figure 2 In the information processing method provided in the corresponding embodiment, refer to Figure 4 As shown, the second information processing device 4 may include: an acquisition unit 41, a second processing unit 42, and a sending unit 43, wherein: The acquisition unit 41 is used to acquire the detection log information of the data processor to be detected and to process the detection log information. The second processing unit 42 is used to extract initial feature information from the processed log information to be detected using a second target temporal convolutional network. The sending unit 43 is used to send initial feature information to the server so that the server can determine whether there is an anomaly in the log information to be detected based on the first feature information in the time dimension and the second feature information in the spatial dimension determined by the initial feature information.

[0100] It should be noted that the specific implementation process of the steps performed by each unit in the embodiments of this application can be referred to Figure 2 The implementation process of the information processing method provided in the corresponding embodiments will not be described in detail here.

[0101] The second information processing device provided in the embodiments of this application, after the terminal determines the initial feature information of the log information to be detected of the data processor to be detected, sends the initial feature information to the server. The server can then determine the feature information in the time dimension and the feature information in the spatial dimension based on the initial feature information sent by the terminal, and jointly determine the anomaly score of the log information to be detected based on the feature information in the time dimension and the feature information in the spatial dimension. Based on the anomaly score, it can be determined whether there is an anomaly in the log information to be detected of the data processor to be detected. This solves the problems of insufficient spatial characteristic modeling and insufficient temporal correlation modeling in the detection schemes of related technologies, and greatly improves the detection efficiency.

[0102] Based on the foregoing embodiments, embodiments of this application provide an information processing device, which may include a server, and the server may be applied to... Figure 1 In the information processing method provided in the corresponding embodiment, refer to Figure 5 As shown, the server 5 may include: a first processor 51, a first memory 52, and a first communication bus 53, wherein: The first communication bus 53 is used to realize the communication connection between the first processor 51 and the first memory 52; The first memory 52 is used to store computer programs that can run on the first processor 51; The first processor 51 is used to run computer programs to perform the following steps: The initial feature information of the log information to be detected sent by the receiving terminal; wherein, the log information to be detected is the log information of the data processor to be detected; Determine the first feature information of the initial feature information in the time dimension; Determine the second feature information of the initial feature information in the spatial dimension; An anomaly score is determined for the log information to be detected based on the first and second feature information. Anomaly scoring determines whether there are anomalies in the log information to be detected.

[0103] In other embodiments of this application, the first processor 51 is used to run a computer program and can also perform the following steps: First temporal feature information is determined to characterize the features of the first duration by identifying the initial feature information; Determine second temporal feature information for characterizing the second duration from the initial feature information; wherein the second duration is greater than the first duration; The first feature information is obtained by fusing the first time feature information and the second time feature information.

[0104] In other embodiments of this application, the first processor 51 is used to run a computer program and can also perform the following steps: The target convolutional gated recurrent network is used to extract features from the initial feature information to obtain the first-time feature information.

[0105] In other embodiments of this application, the first processor 51 is used to run a computer program and can also perform the following steps: The first target temporal convolutional network is used to extract features from the initial feature information to obtain the second temporal feature information.

[0106] In other embodiments of this application, the first processor 51 is used to run a computer program and can also perform the following steps: Construct a target matrix based on the target's physical distribution information and target's logical distribution information; A target multi-head dynamic attention network is used to process the initial feature information and the target matrix to obtain the feature information to be processed; Static feature extraction and dynamic feature extraction are performed on the feature information to be processed to obtain first spatial feature information and second spatial feature information respectively; The second feature information is obtained by fusing the first spatial feature information and the second spatial feature information.

[0107] In other embodiments of this application, the first processor 51 is used to run a computer program and can also perform the following steps: A target convolutional network is used to extract features from the feature information to be processed, thereby obtaining the first spatial feature information; A target multi-head dynamic attention network is used to extract features from the feature information to be processed, thereby obtaining the second spatial feature information.

[0108] In other embodiments of this application, the first processor 51 is used to run a computer program and can also perform the following steps: The first feature information and the second feature information are fused to obtain the fused feature information; Anomaly scores are determined for the log information to be detected based on fused feature information.

[0109] It should be noted that a detailed description of the steps performed by the first processor can be found in [reference needed]. Figure 1 The information processing methods provided in the corresponding embodiments will not be described in detail here.

[0110] The server provided in the embodiments of this application can determine the feature information in the time dimension and the feature information in the spatial dimension based on the initial feature information of the log information to be detected sent by the terminal side, and jointly determine the anomaly score of the log information to be detected based on the feature information in the time dimension and the feature information in the spatial dimension. Based on the anomaly score, it can determine whether there is anomaly in the log information of the data processor to be detected. This solves the problems of insufficient spatial characteristic modeling and insufficient temporal correlation modeling in the detection schemes of related technologies, and greatly improves the detection efficiency.

[0111] Based on the foregoing embodiments, embodiments of this application provide an information processing device, which may include a terminal, and the terminal can be applied to... Figure 2 In the information processing method provided in the corresponding embodiment, refer to Figure 6 As shown, the terminal 6 may include: a second processor 61, a second memory 62, and a second communication bus 63, wherein: The second communication bus 63 is used to realize the communication connection between the second processor 61 and the second memory 62; The second memory 62 is used to store computer programs that can run on the second processor 61; The second processor 61 is used to run computer programs to perform the following steps: Obtain the detection log information of the data processor to be detected, and process the detection log information; A second-target temporal convolutional network is used to extract features from the processed log information to be detected to obtain initial feature information; Initial feature information is sent to the server so that the server can determine whether there are any anomalies in the log information to be detected based on the first feature information in the time dimension and the second feature information in the spatial dimension determined by the initial feature information.

[0112] It should be noted that a detailed description of the steps performed by the second processor can be found in [reference needed]. Figure 2 The information processing methods provided in the corresponding embodiments will not be described in detail here.

[0113] The terminal provided in the embodiments of this application determines the initial feature information of the log information to be detected of the data processor to be detected, and then sends the initial feature information to the server. The server can then determine the feature information in the time dimension and the feature information in the spatial dimension based on the initial feature information sent by the terminal, and jointly determine the anomaly score of the log information to be detected based on the feature information in the time dimension and the feature information in the spatial dimension. Based on the anomaly score, it can be determined whether there is anomaly in the log information to be detected of the data processor to be detected. This solves the problems of insufficient spatial characteristic modeling and insufficient temporal correlation modeling in the detection schemes of related technologies, and greatly improves the detection efficiency.

[0114] Based on the foregoing embodiments, embodiments of this application provide a computer-readable storage medium storing one or more programs, which can be executed by one or more first processors 51 and second processors 61 to achieve... Figure 1 and Figure 2 The corresponding embodiments provide the steps of the information processing method.

[0115] Based on the foregoing embodiments, embodiments of this application provide a computer program product, including a computer program that can be executed by a first processor 51 and a second processor 61 to perform... Figure 1 and Figure 2 The corresponding embodiments provide the steps of the information processing method.

[0116] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0117] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0118] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0119] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0120] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. An information processing method, characterized in that, The method is applied to a server and includes: The receiving terminal sends initial feature information of the log information to be detected; wherein, the log information to be detected is log information for the data processor to be detected; Determine the first feature information of the initial feature information in the time dimension; Determine the second feature information of the initial feature information in the spatial dimension; An anomaly score is determined for the log information to be detected based on the first feature information and the second feature information; The anomaly score is used to determine whether the log information to be detected is abnormal.

2. The method according to claim 1, characterized in that, Determining the first feature information of the initial feature information in the time dimension includes: First temporal feature information is determined from the initial feature information to characterize the features of the first duration; Determine second temporal feature information for characterizing the second duration from the initial feature information; wherein the second duration is greater than the first duration; The first feature information is obtained by fusing the first time feature information and the second time feature information.

3. The method according to claim 2, characterized in that, The first temporal feature information used to characterize the first duration for determining the initial feature information includes: The first temporal feature information is obtained by extracting features from the initial feature information using a target convolutional gated recurrent network. Accordingly, the second temporal feature information used to characterize the second duration for determining the initial feature information includes: The second temporal feature information is obtained by using a first target temporal convolutional network to extract features from the initial feature information.

4. The method according to claim 1, characterized in that, Determining the second feature information of the initial feature information in the spatial dimension includes: Construct a target matrix based on the target's physical distribution information and target's logical distribution information; The initial feature information and the target matrix are processed using a target multi-head dynamic attention network to obtain the feature information to be processed; Static feature extraction and dynamic feature extraction are performed on the feature information to be processed to obtain first spatial feature information and second spatial feature information, respectively; The second feature information is obtained by fusing the first spatial feature information and the second spatial feature information.

5. The method according to claim 4, characterized in that, The step of extracting first spatial feature information and second spatial feature information by performing static feature extraction and dynamic feature extraction on the feature information to be processed, respectively, includes: The first spatial feature information is obtained by using a target convolutional network to extract features from the feature information to be processed. The target multi-head dynamic attention network is used to extract features from the feature information to be processed to obtain the second spatial feature information.

6. The method according to claim 1, characterized in that, The step of determining anomaly scores for the log information to be detected based on the first feature information and the second feature information includes: The first feature information and the second feature information are fused to obtain fused feature information; An anomaly score is determined for the log information to be detected based on the fused feature information.

7. An information processing method, characterized in that, The method is applied to a terminal and includes: Obtain the detection log information of the data processor to be detected, and process the detection log information; A second-target temporal convolutional network is used to extract features from the processed log information to be detected to obtain initial feature information; The initial feature information is sent to the server so that the server can determine whether the log information to be detected is abnormal based on the first feature information in the time dimension and the second feature information in the spatial dimension determined by the initial feature information.

8. An information processing device, characterized in that, The device includes: a processor, a memory, and a communication bus; The communication bus is used to realize the communication connection between the processor and the memory; The processor is used to execute an information processing program in the memory to implement the steps of the information processing method as described in any one of claims 1-6 or 7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more programs, which can be executed by one or more processors to implement the steps of the information processing method as described in any one of claims 1-6 or 7.

10. A computer program product, the computer program product comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the information processing method according to any one of claims 1-6 or 7.

Images