A Method and Device for Anomaly Detection in Power Logs Based on Adaptive Context Learning
By adopting adaptive context learning and compound prompt text design, the problems of low accuracy and uncontrollable results of existing log anomaly detection methods in power systems are solved, and efficient and controllable log anomaly detection is achieved.
Patent Information
- Application Number
- CN202611028686.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-07-10
- Publication Date
- 2026-11-06
AI Technical Summary
Existing log anomaly detection methods rely on a large amount of labeled data in power information systems, have weak generalization ability, and have simple LLM hints that lack experience and knowledge in the power field, resulting in low detection accuracy and uncontrollable results.
Through adaptive context learning, the cosine similarity between the log to be detected and the preset candidate samples is obtained. The top N samples with the highest similarity are selected as context examples. Combined with task instructions and structured judgment rules, a composite prompt text is constructed, which is then input into a large language discrimination model for judgment. The format is parsed to obtain the predicted label in the form of a single word.
It significantly improves the accuracy of log anomaly detection, reduces the dependence on labeled data, makes the model output controllable and suitable for online real-time detection, and reduces the difficulty of system integration.
Smart Images
Figure CN123048702A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the intersection of artificial intelligence and power system security technology, and in particular to a method and apparatus for detecting anomalies in power logs based on adaptive context learning. Background Technology
[0002] With the deepening of the construction of new power systems, critical information systems such as power information systems are becoming increasingly complex. During their operation, these systems generate massive amounts of semi-structured logs, recording crucial information such as system status, communication behavior, and error alarms. Log anomaly detection, as an important means of ensuring the safe and stable operation of the system, can effectively identify potential network attacks, software failures, or configuration errors, and is of great significance for improving the reliability of power systems.
[0003] Currently, mainstream log anomaly detection methods are mainly divided into two categories: methods based on traditional machine learning (such as decision trees, principal component analysis, and invariant mining) and methods based on deep learning (such as DeepLog, LogAnomaly, and NeuralLog). The former usually relies on manual feature engineering and has weak generalization ability; the latter, although capable of automatically learning complex patterns, generally requires a large amount of labeled in-domain training data. However, in power information systems, log anomaly detection faces challenges such as high log annotation costs, strong log dynamism, and extremely sparse log anomalies. Specifically, logs involve knowledge from multiple domains such as SCADA systems, communication protocols, and smart terminals, requiring judgment based on power business rules and even physical laws; frequent upgrades or business changes in power information systems lead to unstable log templates; in addition, the proportion of anomalous logs in real-world scenarios is often less than 0.1%, leading to underfitting or high false alarms in supervised models. In recent years, Large Language Models (LLMs), with their powerful In-Context Learning (ICL) capabilities, have provided a new approach to solving these problems. LLMs do not require parameter updates and can complete downstream tasks simply by embedding a small number of examples in the input prompts. However, existing LLM-based log anomaly detection methods (such as LogPrompt and LogGPT) generally suffer from the following shortcomings: 1. Fixed examples, either randomly generated or manually constructed, are used, without dynamically filtering the most relevant context for each online log entry; 2. The prompt design is simple and lacks structured injection of experience and knowledge in the power field (such as "placeholders are not abnormal" and "only explicit keywords are considered abnormal"). 3. The output format is uncontrollable and easily affected by model illusions, which affects the efficiency and accuracy of result extraction. Summary of the Invention
[0004] This application provides a method and apparatus for detecting power log anomalies based on adaptive context learning, in order to solve the problems of existing log anomaly detection methods relying on a large amount of labeled data, having weak generalization ability, and having coarse LLM prompts.
[0005] Firstly, this application provides a method for detecting anomalies in power logs based on adaptive context learning, including: Obtain the online log to be detected, calculate the cosine similarity between the online log to be detected and each candidate sample in the preset context learning candidate set, and select the top N candidate samples with the highest similarity as context examples; The preset task instructions, preset structured judgment rules, the context example, and the online log to be detected are combined into a composite prompt text; The composite prompt text is input into the constructed large language discrimination model, the judgment result is output, and the format of the judgment result is parsed to obtain the final predicted label of the online log to be detected. The judgment result is a judgment result in the form of a single word.
[0006] Secondly, this application provides a power log anomaly detection device based on adaptive context learning, comprising: The example extraction module is used to obtain the online log to be detected, calculate the cosine similarity between the online log to be detected and each candidate sample in the preset context learning candidate set, and select the top N candidate samples with the highest similarity as context examples. The text generation module is used to combine preset task instructions, preset structured judgment rules, the context example, and the online log to be detected into a composite prompt text; The result prediction module is used to input the composite prompt text into the constructed large language discrimination model, output the judgment result, and perform format parsing on the judgment result to obtain the final predicted label of the online log to be detected. The judgment result is a judgment result in the form of a single word.
[0007] This application provides a method and apparatus for detecting anomalies in power logs based on adaptive context learning. Through adaptive context learning, this application eliminates the need for model retuning for each type of anomaly; instead, it only requires retrieving similar samples from the candidate set to construct prompts, significantly reducing reliance on large amounts of labeled data. The top N candidate samples with the highest similarity to the log to be detected are selected as context examples, providing the model with domain knowledge references most relevant to the current input during inference, significantly improving judgment accuracy compared to fixed examples or zero-sample prompts. Furthermore, the composite prompt simultaneously includes task instructions, structured judgment rules, and dynamic context examples: task instructions clearly define the detection target, structured rules constrain the output format and judgment logic, and context examples provide instance guidance. The collaboration of these three elements makes the output of the large language model both flexible and controllable, avoiding the unpredictability caused by free generation. Simultaneously, the judgment result is in the form of a single word, and the final predicted label can be directly obtained through format parsing, without additional post-processing or complex decoding logic, reducing the difficulty of system integration and making it suitable for online real-time detection scenarios. Attached Figure Description
[0008] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0009] Figure 1 This is a schematic diagram illustrating the implementation process of the power log anomaly detection method based on adaptive context learning provided in this application embodiment; Figure 2 This is a schematic diagram of the structure of the power log anomaly detection device based on adaptive context learning provided in the embodiments of this application. Detailed Implementation
[0010] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.
[0011] To make the objectives, technical solutions, and advantages of this application clearer, the following description will be provided in conjunction with the accompanying drawings and specific embodiments.
[0012] Figure 1 The implementation flowchart of the power log anomaly detection method based on adaptive context learning provided in the embodiments of this application is described in detail below: In step 101, the online log to be detected is obtained, the similarity between the online log to be detected and each candidate sample in the preset context learning candidate set is calculated, and the top N candidate samples with the highest similarity are selected as context examples.
[0013] In this embodiment, when the online log to be detected arrives, its similarity to each candidate sample in the preset context learning candidate set is calculated, and the top N candidate samples with the highest similarity are selected as context examples. Here, N is a positive integer greater than 1.
[0014] In one possible implementation, the method may further include, before acquiring the online logs to be detected: Retrieve multiple labeled local historical logs and use a log parser to parse the local historical logs to generate structured logs. The structured logs contain log templates, log variables, and timestamps for multiple local historical logs. Based on structured logs, a pre-defined candidate set for context learning is constructed.
[0015] Optionally, a small amount of labeled local historical logs can be obtained from the log collection gateway of the power information system. Each local historical log is semi-structured text and may include various fields such as timestamp, event type, IP address, load value, device ID, alarm level, operator, and operation content. These are used to record and analyze information such as system operating status, power load changes, equipment failures, and security events. For example: 2025-06-10 14:30:00 ERROR [DB-001] Connection to device 192.168.1.101 failed with code 503. Then, the system calls the log parser based on the heuristic method Drain, which uses a fixed-depth parse tree, to automatically convert each log message into a specific log template associated with log variables. The log variables (including IP address, memory pointer, floating-point number, file path, timestamp, etc.) are uniformly replaced with placeholders "<". The output includes a structured log containing a log template, log variables, and timestamps.
[0016] For example, suppose the log word sequence (i.e., the local historical log) is... The log parser is based on a preset depth. With length constraints, the log word sequence Log templates divided into static categories With dynamic log variables .
[0017] After parsing, each local historical log entry is output as a triple. For example, log templates It can be "Connection to device< >failed with code< >";Log variables It can be "["192.168.1.101","503"]"; timestamp It could be "2025-6-10 14:30:00".
[0018] All the structured logs mentioned above constitute a context example pool, which is used to construct a preset context learning candidate set.
[0019] This application's embodiments convert labeled local historical logs into structured logs (including templates, variables, and timestamps) through a parser, providing rich and realistically labeled context samples for the candidate set. This ensures that the retrieved context examples are highly relevant to the actual detection scenario, avoiding the problem of mismatch between external general data and the power log domain. In addition, after decomposing the original logs into log templates and log variables, similarity calculation can be based on template semantic matching rather than the surface differences of the original text, effectively avoiding the matching failure problem caused by different variables (such as timestamps and IP address changes) for the same event, making context retrieval more accurate.
[0020] In one possible implementation, a pre-defined candidate set for context learning is constructed based on structured logs, which may include: Each local historical log in the structured log is vectorized to obtain the semantic embedding vector corresponding to each local historical log, and the semantic embedding vectors of all local historical logs are concatenated into a semantic embedding matrix. Calculate the cosine similarity of each pair of semantic embedding vectors in the semantic embedding matrix, and construct a similarity matrix from all the cosine similarities; Based on the similarity matrix, the initial score of each local historical log is determined, the local historical log with the largest initial score is selected as the first candidate sample, and the first candidate sample is stored in the initial candidate set. Calculate the projection coefficient between the first sample and the first candidate sample, and use the initial score of the first sample and the projection coefficient of the first sample to obtain the residual diversity score of the first sample. The first sample is all local historical logs except the local historical logs corresponding to the first candidate sample. Select the local historical log with the highest score from the remaining diversity scores of the first sample as the second candidate sample, and use the second candidate sample to update the first candidate sample and store it in the initial candidate set. Determine whether the number of candidate samples in the initial candidate set has reached the preset number; If the number of candidate samples in the initial candidate set reaches the preset number, the initial candidate set will be used as the preset context learning candidate set. If the number of candidate samples in the initial candidate set does not reach the preset number, the initial score of the first sample is updated using the remaining diversity score of the first sample, and the step of selecting the local historical log with the largest initial score as the first candidate sample is returned to continue execution.
[0021] Optionally, to construct diverse in-context learning (ICL) candidates, a deterministic point process algorithm is employed, the specific process of which is as follows: Log template for each local historical log in the context sample pool The hidden state vector of the [CLS] tag is extracted from the BERT encoder of the pre-trained language model as the semantic embedding vector, i.e.: The semantic embedding vector corresponding to each local historical log is calculated using the first formula, which is: in, For the first The semantic embedding vector corresponding to each local historical log entry. Extracting the first BERT encoder Local historical log template The hidden state vector labeled [CLS] is the first... A local historical log template. For real numbers, is the dimension of the embedding vector.
[0022] All semantic embedding vectors Concatenated into a semantic embedding matrix ,Right now: in, This represents the number of local historical logs.
[0023] Calculate the semantic embedding matrix based on the cosine similarity formula. The cosine similarity between all semantic embedding vectors in the dataset, i.e.: in, For the first semantic embedding vectors With the semantic embedding vectors cosine similarity, The similarity function is cosine similarity, which is solved in this embodiment of the application. For the first semantic embedding vectors transpose, It is an L2 norm.
[0024] Additionally, diagonal elements This represents the similarity of the semantic embedding vectors themselves.
[0025] Construct a similarity matrix from all the semantic embedding vectors mentioned above. .
[0026] Let the initial candidate set be... Utilize each local historical log Corresponding diagonal elements As this local historical log The initial score, i.e. Select the local historical log with the highest initial score. As the first candidate sample, it is added to the initial candidate set. And remove from the context example pool.
[0027] In each iteration, for each first sample that was not selected Based on the current initial candidate set, calculate the first sample for each sample. Compared with the first candidate sample The projection coefficients, i.e.: The projection coefficients between the first sample and the first candidate sample are calculated using the second formula, which is: in, The first sample Compared with the first candidate sample The projection coefficients, i.e., the first sample First candidate sample Intensity of the "interpretable part" in the direction; The first sample Compared with the first candidate sample cosine similarity, , These are auxiliary vectors used for incremental orthogonality, and one auxiliary vector is maintained for each sample; First candidate sample The normalization factor is used to standardize the molecules into projection coefficients, thereby stabilizing the dimensions and values of the projection coefficients.
[0028] And update the auxiliary vector accordingly, that is: in, This is the updated magnitude vector.
[0029] Using the first sample Compared with the first candidate sample projection coefficient Calculate the first sample The remaining diversity score, i.e.: The residual diversity score of the first sample is calculated using the third formula, which is: in, The first sample The remaining diversity score, The first sample Initial score. Remaining diversity score. Reflecting the first sample In the currently selected sample (i.e., the first candidate sample) The orthogonal remaining part of the space.
[0030] Then, the local historical log with the highest remaining diversity score among all the first samples is selected as the second candidate sample, and the first candidate samples are updated using the second candidate samples and added to the initial candidate set. .
[0031] Then determine the initial candidate set. Has the number of candidate samples reached the preset number? If the initial candidate set is reached, it is used as the preset context learning candidate set; if not, the initial score of the first sample is updated using the remaining diversity score of the first sample, and the first candidate sample selection step is repeated until the initial candidate set is reached. The number of candidate samples in the sample reached the preset number. At this point, the initial candidate set It has the greatest diversity and representativeness among candidate samples.
[0032] Among them, the preset quantity The setting is dynamically adjusted based on the size of the local historical logs. The setting rule is: when the number of local historical logs is less than 10,000, the preset number is used. The range is 100-500; the preset number is used when the number of local historical logs is greater than or equal to 10,000. Set according to 1%-5% of the total local historical logs, with a maximum of 1000.
[0033] This application employs a two-tiered mechanism of initial score (semantic relevance) and residual diversity score to screen candidate samples. This ensures that the selected samples are highly correlated with typical anomaly patterns, while also eliminating logs that semantically overlap with the selected samples through projection coefficients. This allows the candidate set to cover more differentiated anomaly types within a limited capacity, improving the recall rate of subsequent retrieval. The residual diversity score is calculated using the projection coefficients of the first sample and the first candidate sample. Essentially, this involves removing the component of the first sample in the direction of the first candidate sample and then evaluating its independent information content. Compared to simple cosine similarity deduplication, this method can more accurately identify and exclude semantically highly similar logs, avoiding the waste of capacity by having multiple substantially identical samples in the candidate set. Furthermore, this application ensures the high quality and diversity of the context learning candidate set from the source, making the subsequently adaptively retrieved context examples both accurate and representative. This fundamentally improves the reliability of the large language model's judgment results and is a key guarantee for the performance of the entire anomaly detection process.
[0034] In one possible implementation, calculating the cosine similarity between the online log to be detected and each candidate sample in a predefined context learning candidate set can include: Calculate the semantic embedding vector of the online log to be detected, and calculate the semantic embedding vector of each candidate sample in the preset context learning candidate set; Calculate the cosine similarity between the semantic embedding vector of the online log to be detected and the semantic embedding vector of each candidate sample in the preset context learning candidate set, and store all cosine similarities in the preset similarity distance mapping table.
[0035] Optionally, candidate sets are learned from a preset context. Selected from online logs to be tested The N most relevant candidate samples are used as subsequent prompts. The specific process is as follows: Create a distance mapping table to store the similarity between the logs to be detected and the candidate samples. And create an example set to store the N final selected context examples. .
[0036] Online logs to be detected log template Input the same BERT encoder to obtain the online logs to be detected. semantic embedding vector .
[0037] Determine the preset context learning candidate set Candidate samples semantic embedding vector .
[0038] Then, calculate the online logs to be detected respectively. semantic embedding vector With preset context learning candidate set Candidate samples semantic embedding vector cosine similarity And store all cosine similarities into a preset similarity distance mapping table. In, that is: .
[0039] In this application embodiment, the cosine similarity is calculated after mapping both the log to be detected and the candidate samples to semantic embedding vectors. The matching is based on deep semantics rather than keywords or template strings, which can effectively identify logs with different expressions but the same meaning, and avoid the problem of missed detection based on rule matching.
[0040] In one possible implementation, after selecting the top N candidate samples with the highest similarity as context examples, the method may further include: Sort the N candidate samples in the context examples in ascending order of similarity scores to obtain the sorted context examples; Accordingly, the preset task instructions, preset structured judgment rules, context examples, and the online logs to be detected are combined into a composite prompt text, which may include: The preset task instructions, preset structured judgment rules, sorted context examples, and online logs to be detected are combined into a composite prompt text.
[0041] Optionally, from a preset similarity distance mapping table The top N candidate samples with the highest similarity are selected to form the context examples, i.e., the example set. Furthermore, the corresponding cosine similarity decreases sequentially. Then, to improve log parsing performance, during the suggestion construction process, based on the selected context example... With the online logs to be detected The similarity to the selected context examples Sort the context examples in ascending order of similarity to obtain the sorted examples. That is, the least similar example is placed first, followed by the most similar example; this sequence will be used to prompt the construction.
[0042] Because large language models exhibit a proximal bias in context learning—meaning they are more susceptible to inductive bias when generating answer predictions by referencing examples closer to the target—this application addresses this issue by ranking examples based on similarity. This ranking of examples closer to the target makes it easier for the large language model to learn the hidden relationship between the last example and its label, resulting in more accurate predictions.
[0043] In step 102, the preset task instructions, preset structured judgment rules, context examples, and online logs to be detected are combined into a composite prompt text.
[0044] The preset task instructions are standardized task instructions written by the system, clearly defining the classification tasks that the model needs to perform. These preset task instructions are fixed text, such as: "You are a power system log analysis expert. Your task is to determine whether a given log entry indicates abnormal system behavior. If the log clearly describes a fault, error, or alarm, output only 'abnormal'; otherwise, output 'normal'." This preset task instruction uses a combination of role setting and output constraints, giving the model a professional identity while strictly limiting its output space, preventing arbitrary generation.
[0045] Preset structure The transformation determination rule is as follows: "When evaluating each log entry, follow these inference rules:" Rule 1: Placeholders < in the log The replaced content (such as IP address, memory pointer, floating-point number, file path, etc.) belongs to variables that are normally running and should not be considered abnormal; Rule 2: Log entries containing only routine operational information (such as status updates, heartbeat signals, or parameter settings) are considered normal, even if they contain technical terms; Rule 3: A log entry should only be marked as "abnormal" if it contains explicit exception indicators (such as error, failure, crash, interrupt, alert, exception, segfault, etc.). If no such keywords are present, it should be considered "normal".
[0046] In this embodiment, the context examples are sorted context examples, and the system writes the sorted context examples into the prompt one by one according to a fixed format. Each example contains two parts: log content and annotation tags, in the following format: Log entries: [Log content 1] Response: [abnormal / normal] Log entries: [Log content 2] Response: [abnormal / normal] …”.
[0047] The online logs to be detected are appended to the end of the prompt in the same format, but no tags are provided, only placeholders are retained, i.e.: "Log entries: [Log content to be detected] Response:".
[0048] In this embodiment, preset task instructions, preset structured judgment rules, sorted context examples, and online logs to be detected are organically integrated to form a complete, clear, and formatted text prompt, i.e., a composite prompt text. This maximizes the contextual reasoning ability of the large language discrimination model, and the structure of the composite prompt text ensures that the large language discrimination model understands the task, masters the rules, learns the examples, and makes accurate predictions.
[0049] In step 103, the compound prompt text is input into the constructed large language discrimination model, the judgment result is output, and the format of the judgment result is parsed to obtain the final predicted label of the online log to be detected. The judgment result is a judgment result in the form of a single word.
[0050] The large language discrimination model that has been built is an open-source large language model of 7B-13B, deployed on local servers or edge computing nodes of the power system. The model does not rely on any external API calls, and all log data is processed within the intranet, ensuring that the data does not leave the domain and meeting the stringent requirements of the power system for data security and privacy.
[0051] In addition, the judgment result output in this embodiment is "abnormal" or "normal".
[0052] In this embodiment, the constructed composite prompt text is input into a pre-built large language discrimination model. Without updating any parameters, the model understands the log semantics and performs category reasoning based on preset task instructions and preset structured judgment rules. To ensure the determinism and parsability of the output, the system imposes strict constraints on the model's generation process: the model is only allowed to generate a single token at the end of the prompt, and this token must be one of two predefined tags, namely "abnormal" or "normal". The specific constraint can be implemented as follows: a constrained decoding strategy is adopted in the decoding stage, retaining only two valid tags in the candidate vocabulary. After outputting the judgment result, the result is parsed to obtain the final predicted tag.
[0053] In one possible implementation, the judgment result is parsed to obtain the final predicted label of the online log to be detected, which may include: The system uses a preset regular expression to perform a full string match on the judgment result and determines whether the match is successful. If a match is found, the result will be used as the final predicted label. If a match fails, an exception handling mechanism is triggered.
[0054] Optionally, after outputting the judgment result, the automated result extraction process can be started immediately, i.e.: The default regular expression "^(normal|abnormal)$" is used to perform a full string match on the result. This expression requires the output to be exactly equal to "normal" or "abnormal", and any extra characters (such as spaces or periods) will cause the match to fail.
[0055] If a match is successful, the tag extracted from the judgment result will be used as the final predicted tag for the online log to be detected and output to the upper layer application.
[0056] If a match fails, the system triggers an exception handling mechanism: Record the output judgment result and the log content of the online log to be detected for subsequent manual review; The default value is "normal", following the conservative strategy of "normal if there is no explicit abnormality".
[0057] The format parsing design in this application effectively avoids the common "illusion" problem and redundant output risk of large language discrimination models, ensuring the accuracy, efficiency and repeatability of result extraction; at the same time, the entire inference process does not require model fine-tuning, and only relies on the open source large language model deployed locally.
[0058] In one possible implementation, before inputting the compound prompt text into the already constructed large language discrimination model and outputting the judgment result, the method may further include: To improve reasoning efficiency, the system preprocesses the length of the compound prompt text: Log templates remove variables, significantly reducing text length; Only N examples are retained (N≤9), and the context window is controlled within the maximum model length.
[0059] To verify the feasibility of the solutions provided in the embodiments of this application, Table 1 presents the experimental results of the embodiments of this application and the LogGPT and LogPrompt methods on the BGL, Spirit, and WAF datasets.
[0060] Table 1 Comparison of Experimental Results The experiments used F1 score (F), precision (P), and recall (R) as evaluation metrics. BGL and Spirit were publicly available datasets, while WAF was a dataset constructed using the methods described in this application. LogGPT utilizes the generative capabilities of a large language model to model log semantics and directly output analysis results. LogPrompt is a log analysis method based on prompt engineering, guiding the large language model to complete log parsing and anomaly detection through manually designed task instructions and examples. To ensure fairness in the comparison, all three methods were tested using the DeepSeek-R1-Distill-Llama-8B model. The data shows that the proposed method exhibits superior overall performance compared to LogGPT and LogPrompt on the BGL, Spirit, and WAF datasets.
[0061] This application provides a power log anomaly detection method based on adaptive context learning. Through adaptive context learning, this method eliminates the need for model retuning for each anomaly type; instead, it constructs prompts simply by retrieving similar samples from the candidate set, significantly reducing reliance on large amounts of labeled data. The method selects the top N candidate samples with the highest similarity to the log to be detected as context examples, providing the model with domain knowledge references most relevant to the current input during inference, significantly improving judgment accuracy compared to fixed examples or zero-sample prompts. Furthermore, the composite prompt simultaneously includes task instructions, structured judgment rules, and dynamic context examples: task instructions clearly define the detection target, structured rules constrain the output format and judgment logic, and context examples provide instance guidance. The collaboration of these three elements makes the output of the large language model both flexible and controllable, avoiding the unpredictability caused by free generation. Simultaneously, the judgment result is in single-word form, and the final predicted label can be directly obtained through format parsing, without additional post-processing or complex decoding logic, reducing system integration difficulty and making it suitable for online real-time detection scenarios.
[0062] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.
[0063] The following are device embodiments of this application. For details not described in detail, please refer to the corresponding method embodiments described above.
[0064] Figure 2 A schematic diagram of the power log anomaly detection device based on adaptive context learning provided in an embodiment of this application is shown. For ease of explanation, only the parts related to the embodiment of this application are shown, and are described in detail below: like Figure 2 As shown, the power log anomaly detection device 2 based on adaptive context learning includes: Example extraction module 21 is used to obtain the online log to be detected, calculate the cosine similarity between the online log to be detected and each candidate sample in the preset context learning candidate set, and select the top N candidate samples with the highest similarity as context examples. The text generation module 22 is used to combine preset task instructions, preset structured judgment rules, context examples, and online logs to be detected into composite prompt text; The result prediction module 23 is used to input the compound prompt text into the constructed large language discrimination model, output the judgment result, and perform format parsing on the judgment result to obtain the final predicted label of the online log to be detected. The judgment result is a judgment result in the form of a single word.
[0065] This application provides an anomaly detection device for power logs based on adaptive context learning. Through adaptive context learning, this application eliminates the need for model retuning for each type of anomaly; it only requires retrieving similar samples from the candidate set to construct prompts, significantly reducing reliance on large amounts of labeled data. It selects the top N candidate samples with the highest similarity to the log to be detected as context examples, providing the model with domain knowledge references most relevant to the current input during inference, significantly improving judgment accuracy compared to fixed examples or zero-sample prompts. Furthermore, the composite prompt simultaneously includes task instructions, structured judgment rules, and dynamic context examples: task instructions clearly define the detection target, structured rules constrain the output format and judgment logic, and context examples provide instance guidance. The collaboration of these three elements makes the output of the large language model both flexible and controllable, avoiding the unpredictability caused by free generation. Simultaneously, the judgment result is in the form of a single word, and the final predicted label can be directly obtained through format parsing, without additional post-processing or complex decoding logic, reducing the difficulty of system integration and making it suitable for online real-time detection scenarios.
[0066] In one possible implementation, the device may further include a candidate set construction module, which can be used to: Retrieve multiple labeled local historical logs and use a log parser to parse the local historical logs to generate structured logs. The structured logs contain log templates, log variables, and timestamps for multiple local historical logs. Based on structured logs, a pre-defined candidate set for context learning is constructed.
[0067] In one possible implementation, the candidate set building module can be used for: Each local historical log in the structured log is vectorized to obtain the semantic embedding vector corresponding to each local historical log, and the semantic embedding vectors of all local historical logs are concatenated into a semantic embedding matrix. Calculate the cosine similarity of each pair of semantic embedding vectors in the semantic embedding matrix, and construct a similarity matrix from all the cosine similarities; Based on the similarity matrix, the initial score of each local historical log is determined, the local historical log with the largest initial score is selected as the first candidate sample, and the first candidate sample is stored in the initial candidate set. Calculate the projection coefficient between the first sample and the first candidate sample, and use the initial score of the first sample and the projection coefficient of the first sample to obtain the residual diversity score of the first sample. The first sample is all local historical logs except the local historical logs corresponding to the first candidate sample. Select the local historical log with the highest score from the remaining diversity scores of the first sample as the second candidate sample, and use the second candidate sample to update the first candidate sample and store it in the initial candidate set. Determine whether the number of candidate samples in the initial candidate set has reached the preset number; If the number of candidate samples in the initial candidate set reaches the preset number, the initial candidate set will be used as the preset context learning candidate set. If the number of candidate samples in the initial candidate set does not reach the preset number, the initial score of the first sample is updated using the remaining diversity score of the first sample, and the step of selecting the local historical log with the largest initial score as the first candidate sample is returned to continue execution.
[0068] In one possible implementation, the candidate set building module can also be used for: The semantic embedding vector corresponding to each local historical log is calculated using the first formula, which is: in, For the first The semantic embedding vector corresponding to each local historical log entry. Extracting the first BERT encoder Local historical log template The hidden state vector labeled [CLS] is the first... A local historical log template. For real numbers, is the dimension of the embedding vector.
[0069] In one possible implementation, the candidate set building module can also be used for: The projection coefficients between the first sample and the first candidate sample are calculated using the second formula, which is: in, The first sample Compared with the first candidate sample The projection coefficient, The first sample Compared with the first candidate sample cosine similarity, , These are auxiliary vectors, First candidate sample The normalization factor.
[0070] In one possible implementation, the candidate set building module can also be used for: The residual diversity score of the first sample is calculated using the third formula, which is: in, The first sample The remaining diversity score, The first sample The initial score.
[0071] In one possible implementation, the example extraction module can be used for: Calculate the semantic embedding vector of the online log to be detected, and calculate the semantic embedding vector of each candidate sample in the preset context learning candidate set; Calculate the cosine similarity between the semantic embedding vector of the online log to be detected and the semantic embedding vector of each candidate sample in the preset context learning candidate set, and store all cosine similarities in the preset similarity distance mapping table.
[0072] In one possible implementation, the device may further include a sorting module, which can be used to: Sort the N candidate samples in the context examples in ascending order of similarity scores to obtain the sorted context examples; Accordingly, the text generation module can be used for: The preset task instructions, preset structured judgment rules, sorted context examples, and online logs to be detected are combined into a composite prompt text.
[0073] In one possible implementation, the result prediction module can be used for: The system uses a preset regular expression to perform a full string match on the judgment result and determines whether the match is successful. If a match is found, the result will be used as the final predicted label. If a match fails, an exception handling mechanism is triggered.
[0074] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.
[0075] Those skilled in the art will recognize that the templates, units, and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.
[0076] If the module / unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium. When executed by a processor, the computer program can implement the steps of the above embodiments of the power log anomaly detection method based on adaptive context learning. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory, a random access memory, an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc.
[0077] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.
Claims
1. A power log anomaly detection method based on adaptive context learning, characterized in that, include: Obtain the online log to be detected, calculate the cosine similarity between the online log to be detected and each candidate sample in the preset context learning candidate set, and select the top N candidate samples with the highest similarity as context examples; The preset task instructions, preset structured judgment rules, the context example, and the online log to be detected are combined into a composite prompt text; The composite prompt text is input into the constructed large language discrimination model, the judgment result is output, and the format of the judgment result is parsed to obtain the final predicted label of the online log to be detected. The judgment result is a judgment result in the form of a single word. 2.The adaptive context learning based power log anomaly detection method of claim 1, wherein, Before acquiring the online logs to be detected, the method further includes: Multiple labeled local historical logs are obtained, and the local historical logs are parsed using a log parser to generate structured logs. The structured logs contain log templates, log variables, and timestamps for multiple local historical logs. Based on the structured logs, the preset context learning candidate set is constructed. 3.The adaptive context learning based power log anomaly detection method of claim 2, wherein, The step of constructing the preset context learning candidate set based on the structured logs includes: Each local historical log in the structured log is vectorized to obtain a semantic embedding vector corresponding to each local historical log, and the semantic embedding vectors of all local historical logs are concatenated into a semantic embedding matrix. Calculate the cosine similarity for each pair of semantic embedding vectors in the semantic embedding matrix, and construct a similarity matrix from all the cosine similarities; Based on the similarity matrix, the initial score of each local historical log is determined, the local historical log with the largest initial score is selected as the first candidate sample, and the first candidate sample is stored in the initial candidate set. Calculate the projection coefficient between the first sample and the first candidate sample, and use the initial score of the first sample and the projection coefficient of the first sample to obtain the residual diversity score of the first sample. The first sample is all local historical logs except the local historical logs corresponding to the first candidate sample. Select the local historical log with the highest remaining diversity score from the first sample as the second candidate sample, and use the second candidate sample to update the first candidate sample, and store it in the initial candidate set; Determine whether the number of candidate samples in the initial candidate set has reached a preset number; If the number of candidate samples in the initial candidate set reaches the preset number, then the initial candidate set is used as the preset context learning candidate set; If the number of candidate samples in the initial candidate set does not reach the preset number, the initial score of the first sample is updated using the remaining diversity score of the first sample, and the step of selecting the local historical log with the largest initial score as the first candidate sample is returned to continue execution. 4.The adaptive context learning based power log anomaly detection method of claim 3, wherein, The step of vectorizing each local historical log in the structured log to obtain a semantic embedding vector corresponding to each local historical log includes: The semantic embedding vector corresponding to each local historical log is calculated using the first formula, which is: wherein, is the semantic embedding vector corresponding to the local history log, is the log template of the BERT encoder extracts the hidden state vector of the [CLS] token of the log template of the local history log, is a real number, is the dimension of the embedding vector. 5.The adaptive context learning based power log anomaly detection method of claim 3, wherein, The calculation of the projection coefficient between the first sample and the first candidate sample includes: The projection coefficient between the first sample and the first candidate sample is calculated using a second formula, which is: wherein is the first sample a projection coefficient of the first candidate sample , is the first sample a cosine similarity of the first candidate sample , , are auxiliary vectors, respectively, is a normalization factor of the first candidate sample . 6.The adaptive context learning based power log anomaly detection method of claim 5, wherein, The step of obtaining the residual diversity score of the first sample by using the initial score of the first sample and the projection coefficient of the first sample includes: The residual diversity score of the first sample is calculated using a third formula, which is: wherein, is the remaining diversity score of the first sample , is the initial score of the first sample . 7.The adaptive context learning based power log anomaly detection method of claim 1, wherein, The calculation of the cosine similarity between the online log to be detected and each candidate sample in the preset context learning candidate set includes: Calculate the semantic embedding vector of the online log to be detected, and calculate the semantic embedding vector of each candidate sample in the preset context learning candidate set; Calculate the cosine similarity between the semantic embedding vector of the online log to be detected and the semantic embedding vector of each candidate sample in the preset context learning candidate set, and store all cosine similarities in a preset similarity distance mapping table. 8.The adaptive context learning based power log anomaly detection method of claim 1, wherein, After selecting the top N candidate samples with the highest similarity as context examples, the method further includes: The N candidate samples in the context example are sorted in ascending order of similarity value to obtain the sorted context example; Accordingly, the step of combining the preset task instruction, the preset structured judgment rule, the context example, and the online log to be detected into a composite prompt text includes: The preset task instructions, preset structured judgment rules, sorted context examples, and the online log to be detected are combined into a composite prompt text. 9.The adaptive context learning based power log anomaly detection method of claim 1, wherein, The step of parsing the judgment result to obtain the final predicted label of the online log to be detected includes: The judgment result is matched against the entire string using a preset regular expression, and it is determined whether the match is successful. If a match is successful, the determination result will be used as the final predicted label. If a match fails, an exception handling mechanism is triggered.
10. An adaptive context learning based power log anomaly detection apparatus, characterized by, include: The example extraction module is used to obtain the online log to be detected, calculate the cosine similarity between the online log to be detected and each candidate sample in the preset context learning candidate set, and select the top N candidate samples with the highest similarity as context examples. The text generation module is used to combine preset task instructions, preset structured judgment rules, the context example, and the online log to be detected into a composite prompt text; The result prediction module is used to input the composite prompt text into the constructed large language discrimination model, output the judgment result, and perform format parsing on the judgment result to obtain the final predicted label of the online log to be detected. The judgment result is a judgment result in the form of a single word.