Inference device and learning device

Abstract

This inference device comprises: a first model that receives an unstructured portion of a log as an input and calculates a first output; a second model that receives a structured portion of the log as an input and calculates a second output; and an abnormality degree calculation unit that calculates, as an abnormality degree, a weighted sum of the first output and the second output.

Description

Inference device and learning device

[0001] The present invention relates to a technique for performing log analysis.

[0002] Logs, which are semi-structured texts output from systems, software, devices, etc., record information about their execution and are important data that allow for checking the status and operation of those devices at runtime (Non-Patent Document 1). Log analysis is necessary for early detection of system failures, etc. However, logs obtained from large-scale, complex systems are often voluminous and complicated, and there is a need to streamline log analysis, so research into automated log analysis is underway.

[0003] Automated log analysis consists of the processes of log parsing and log anomaly detection. Log parsing in particular involves a task called parsing. Parsing involves breaking down the semi-structured text of each line of the log into a structured portion and an unstructured portion, and then breaking down the unstructured portion into a template portion, which is fixed text, and a parameter portion, which is filled with variables, etc. The structured portion is a structured portion whose configuration is known from system specifications, etc., and which can be decomposed into patterns using regular expressions, etc. The unstructured portion is an unstructured portion written in text.

[0004] He, S., He, P., Chen, Z., Yang, T., Su, Y., and Lyu, MR, "A Survey on Automated Log Analysis for Reliability Engineering", arXiv:2009.07237, 2020."BGL," logpai / loghub. https: / / github.com / logpai / loghub / tree / master / BGL

[0005] In conventional technologies, only the unstructured part of a log is used as input for log anomaly detection. However, when only the unstructured part of a log is used as input, there is a problem that the accuracy of anomaly detection decreases due to the influence of parsing failures, etc.

[0006] The present invention has been made in view of the above points, and has an object to provide a technique that enables improvement in the accuracy of anomaly detection in log anomaly detection.

[0007] According to the disclosed technology, an inference device is provided that includes: a first model that takes an unstructured portion of a log as input and calculates a first output; a second model that takes a structured portion of the log as input and calculates a second output; and an anomaly degree calculation unit that calculates a weighted sum of the first output and the second output as an anomaly degree.

[0008] The disclosed technology provides a technology that enables improvement in anomaly detection accuracy in log anomaly detection.

[0009] 1 is a diagram showing the flow of automatic log analysis. A diagram showing an example of the result of log parsing. A diagram showing an example of the configuration of the log anomaly detection device 100. A flowchart showing the flow of learning. A diagram showing an example of parsed log data. A diagram for explaining the process when learning the unstructured partial input model 110. A diagram showing the configuration of the unstructured partial input model 110. A diagram for explaining the process when learning the structured partial input model 140. A diagram showing the configuration of the structured partial input model 120. A diagram showing functional units used in anomaly degree calculation, and the input and output of each functional unit in the anomaly degree calculation. A flowchart showing the flow of anomaly degree calculation. A diagram showing functional units used in determining α and β, and the input and output of each functional unit. A flowchart showing the flow of parameter determination processing. A diagram showing an example of the configuration of a learning device 200. A diagram showing an example of the configuration of an inference device 300. A diagram showing an example of the configuration of a parameter determination device 400. A diagram showing an example of the hardware configuration of the device.

[0010] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0011] In the text of this specification, for convenience of description, letters representing vectors are written in normal font, and it is clear from the context that the letters represent vectors.

[0012] In the following, first, the conventional technology and its problems will be described in more detail, and then the technology according to the present embodiment will be described.

[0013] (Regarding Prior Art) As mentioned above, logs, which are semi-structured texts output from systems, software, devices, etc., record information at the time of their execution and are important data that enable confirmation of the status and operation at the time of execution (Non-Patent Document 1). In addition, there is a need to analyze logs more efficiently, and research into automatic log analysis is underway.

[0014] Figure 1 shows the flow of automatic log analysis. As shown in Figure 1, automatic log analysis consists of the processes of log parsing and log anomaly detection. Log parsing involves a process called parsing. Parsing decomposes the semi-structured text of each line of the log into a structured portion and an unstructured portion, and then decomposes the unstructured portion into a template portion, which is fixed text, and a parameter portion, which is assigned variables, etc. The structured portion is a structured portion whose configuration is known from system specifications, etc., and which can be decomposed by patterning it using regular expressions, etc. The unstructured portion is an unstructured portion written in text.

[0015] Fig. 2 is a diagram showing an example of the results of log parsing. Fig. 2 shows an example of log parsing performed on a BGL log (Non-Patent Document 2). As shown in Fig. 2, the log is decomposed into a structured part and an unstructured part, and the unstructured part is decomposed into a template part and a parameter part.

[0016] The unstructured part of the log is the part that the system developer can write in free-form natural language, and the template part contains the most important information in the log.

[0017] In conventional log anomaly detection, the template portion of the unstructured part of the log, which has been transformed by log parsing, is used as input data, and machine learning is used to extract patterns and trends from the log and determine whether the system is normal or abnormal.

[0018] (About the issue) The template part in the unstructured part of the log is thought to contain particularly important information among the logs, and has been used as input in automatic log analysis.

[0019] However, since the unstructured part of the log is written in free format, it is difficult to separate the template part and the parameter part during log parsing, and some logs may fail to be parsed.

[0020] If the original template had been entered, the system would have been judged to be normal, but due to a parsing failure, parameters may be mixed into the template, resulting in a different input, which may result in the system being judged to be abnormal.

[0021] Furthermore, even though the template portion is written in text, it differs from typical text formats. Therefore, for example, when converting a template into a numerical vector so that it can be input to a model, even if a typical language processing model is applied, the meaning may not be properly expressed (for example, templates with similar meanings may be far apart in the embedding space), resulting in poor model training and sparse anomaly detection results. These problems stem from the difficulty of using text from logs as input.

[0022] (Outline of the embodiment) Important information is often recorded in the unstructured part of the log, but the structured part also has different trends depending on whether it is normal or abnormal. For example, in BGL data, the level of the structured part tends to be INFO under normal conditions, and FATAL under abnormal conditions.

[0023] The structured part is written in a fixed format, so patterns can be easily extracted using regular expressions, meaning parsing will never fail, and it has the advantage of being easy to handle as input data for log anomaly detection.

[0024] Therefore, in this embodiment, the log anomaly detection device 100 (described later) uses not only the unstructured part of the log but also the structured part of the log as input data when detecting an anomaly in the log, thereby suppressing a decrease in anomaly detection accuracy due to parsing failures or the large number of possible formats of input data, and improving the accuracy of anomaly detection.

[0025] The configuration and operation of the log anomaly detection device 100 will be described in detail below.

[0026] 3 is a diagram showing an example of the configuration of the log anomaly detection device 100 according to this embodiment. The log anomaly detection device 100 includes an unstructured partial input model 110, a structured partial input model 120, an unstructured partial loss calculation unit 130, a structured partial loss calculation unit 140, an anomaly degree calculation unit 150, an anomaly degree calculation parameter determination unit 160, and a database 170.

[0027] The log anomaly detection device 100 performs both learning and inference (anomaly detection), but the learning function and the inference function may be separate devices. An example of this will be described later. Furthermore, focusing on the learning function of the log anomaly detection device 100, the log anomaly detection device 100 may be called a learning device. Furthermore, focusing on the inference function of the log anomaly detection device 100, the log anomaly detection device 100 may be called an inference device.

[0028] The following describes the operations of the log anomaly detection device 100 for model learning, anomaly degree calculation, and parameter determination.

[0029] (Regarding Model Learning) The learning of the unstructured partial input model 110 and the structured partial input model 120 will be described. Here, it is assumed that the learning unit 180 controls the learning. First, the flow of learning executed by the learning unit 180 will be described with reference to FIG. 4.

[0030] In S101 (step 101), the learning unit 180 inputs input data to the model, and in S102, obtains output from the model. In S103, the loss calculation unit calculates the loss based on the output from the model. In S104, the learning unit 180 updates the parameters of the model so as to minimize the loss. The learning unit 180 repeats S101 to S104 until learning is completed (S105). Below, the learning of each of the unstructured partial input model 110 and the structured partial input model 120 will be described in more detail.

[0031] Learning can be either supervised learning or unsupervised learning. However, the unstructured partial input model 110 and the structured partial input model 120 must be the same in terms of whether they are supervised learning models or unsupervised learning models. In other words, if the unstructured partial input model 110 is a supervised learning model, the structured partial input model 120 must also be a supervised learning model, and if the unstructured partial input model 110 is an unsupervised learning model, the structured partial input model 120 must also be an unsupervised learning model.

[0032] Parsed log data that has been parsed in advance is stored in the database 170. The parsed log data includes parsed log data for learning (hereinafter referred to as learning data), parsed log data for verification (hereinafter referred to as verification data), and parsed log data for testing (hereinafter referred to as test data).

[0033] 5 shows an example of parsed log data. The parsed log data represents the parsed log in table format. When a supervised learning model is used, a label column t is added to the training data and validation data, where the column is 0 for normal and 1 for abnormal. Parameter values ​​and functions calculated by the model, calculation unit, etc. are also stored in the database 170.

[0034] <Learning of Unstructured Partial Input Model 110> First, a description will be given of the learning of the unstructured partial input model 110. Fig. 6 is a diagram for explaining the processing when learning the unstructured partial input model 110. As shown in Fig. 6, the unstructured partial input model 110 and the unstructured partial loss calculation unit 130 are used for learning the unstructured partial input model 110.

[0035] As the unstructured partial input model 110, for example, a model that is generally used for log anomaly detection (such as DeepLog, LogAnomaly, or LogRobust) can be used.

[0036] DeepLog is disclosed in M. Du, F. Li, G. Zheng and V. Srikumar, "DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning," Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 1285-1298, October 2017.

[0037] LogAnomaly is disclosed in R. Zhou, P. Sun, S. Tao, R. Zhang, W. Meng, Y. Liu, et al., "LogAnomaly: Unsupervised Detection of Sequential and Quantitative Anomalies in Unstructured Logs," IJCAI, pp. 4739-4745, 2019.

[0038] LogRobust is disclosed in "X. Zhang, Y. Xu, Q. Lin, B. Qiao, H. Zhang, Y. Dang, et al., "Robust log-based anomaly detection on unstable log data," Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp. 807-817, August 2019."

[0039] 7, the unstructured partial input model 110 includes a preprocessing unit 111 that performs preprocessing and an analysis unit 112 that performs analysis. Note that the preprocessing unit 111 may be located outside the unstructured partial input model 110.

[0040] As input data to the unstructured portion input model 110, a template portion in the unstructured portion of the training data is used.

[0041] When a template portion is input to the unstructured portion input model 110, a preprocessing unit 111 first performs preprocessing to convert the log of the template portion into a numerical vector. The preprocessing unit 111 performs the conversion into the numerical vector by, for example, one-hot encoding. The preprocessing unit 111 may also be a language model such as word2vec or BERT, in which case the preprocessing unit 111 performs embedding using the language model.

[0042] The numerical vector obtained by the preprocessing is input to the analysis unit 112. The analysis unit 112 is a machine learning model such as a convolutional neural network (CNN) or a recurrent neural network (RNN). The output from the analysis unit 112 is the output from the unstructured partial input model 110.

[0043] In the case of supervised learning, the output of the unstructured partial input model 110 is a number between 0 and 1 (y ＳＵＰThe unstructured partial loss calculation unit 130 calculates the loss l ＳＵＰ Let y be the model output. ＳＵＰ and the label t, the calculation is performed using the following formula:

[0044] l ＳＵＰ = f ＳＵＰ (y ＳＵＰ , t) f ＳＵＰ (y ＳＵＰ , t) represents a loss function. As the loss function, for example, the binary cross entropy error expressed by the following formula is used.

[0045] f ＳＵＰ (y ＳＵＰ ,t)=-{tlogy ＳＵＰ +(1-t)log(1-y ＳＵＰ In the case of unsupervised learning, there are two types of output methods from the unstructured partial input model 110. Hereinafter, they will be described as Example 1 and Example 2.

[0046] In the case of unsupervised learning, Example 1, the reconstruction of the input to the model is the output from the model. In this case, the output is a vector of the same dimension as the input (this is called y ＵＮ The unstructured partial loss calculation unit 130 calculates the loss l ＵＮ Let y be the output from the model. ＵＮ and the input to the model (denoted as x) are used to calculate using the following formula:

[0047] l ＵＮ = f ＵＮ (y ＵＮ , x) f ＵＮ (y ＵＮ , x) represents a loss function. For example, the squared error shown below is used as the loss function.

[0048] f ＵＮ (y ＵＮ , x)=(y ＵＮ -x) ２Example 2 of unsupervised learning is a method in which the number of template types is the number of dimensions (C), each element takes a value between 0 and 1, and the output is a vector whose sum of the elements is 1. This method is unsupervised learning but is specific to log anomaly detection, using template types like labels, and is used in DeepLog, LogAnolamy, etc.

[0049] The output from the unstructured partial input model 110 at this time is expressed as y ＴＥＭＰ The unstructured partial loss calculation unit 130 first calculates a vector E １ The unstructured partial loss calculation unit 130 further calculates y ＴＥＭＰ The vector E of dimension C is referred to, and the largest e (any integer 1≦e≦C) elements are set to 1 and the rest are set to 0. ２ Note that "a large numerical value" may mean that the numerical value is larger than a predetermined threshold value.

[0050] Then, the unstructured partial loss calculation unit 130 calculates the loss l ＴＥＭＰ Let y be the model output. ＴＥＭＰ and E １ , E ２ Calculate using the following formula:

[0051] l ＴＥＭＰ = f ＴＥＭＰ (y ＴＥＭＰ , E １ , E ２ ) f ＴＥＭＰ (y ＴＥＭＰ , E １ , E ２ ) the following formula is used:

[0052] In addition, y ＴＥＭＰ，ｉ is the vector y ＴＥＭＰ represents an element of ２，ｉ is vector E ２ represents an element of y, and μ represents a very large positive number. ＴＥＭＰ The element representing the correct template is included within the e elements with the largest numerical values ​​in f, and the larger the values ​​of the e elements, the smaller the value becomes.ＴＥＭＰ (y ＴＥＭＰ , E １ , E ２ ) may be used as the cross entropy error. １，ｉ is E １ Represents an element of.

[0053] The training unit 180 trains the unstructured partial input model 110 using the loss l ＳＵＰ Or loss l ＵＮ Or loss l ＴＥＭＰ That is, the parameters of the unstructured partial input model 110 are adjusted.

[0054] <Learning of structured partial input model 120> Next, a description will be given of the learning of the structured partial input model 120. Fig. 8 is a diagram for explaining the processing when learning the structured partial input model 140. As shown in Fig. 8, the structured partial input model 120 and the structured partial loss calculation unit 140 are used for learning the structured partial input model 110.

[0055] 9, the structured partial input model 120 includes a preprocessing unit 121 that performs preprocessing and an analysis unit 122 that performs analysis. Note that the preprocessing unit 121 may be located outside the structured partial input model 120.

[0056] The structured portion of the training data is input to the structured portion input model 120 as table data.

[0057] If a column of a categorical variable exists in the structured portion, the preprocessing unit 121 performs preprocessing to convert the categorical variable into a dummy variable. If necessary, the column to be used may be included as part of the structured portion.

[0058] The preprocessed input data is input to the analysis unit 122. The analysis unit 122 is, for example, a machine learning model such as an autoencoder (AE) or a deep neural network (DNN). The output from the analysis unit 122 is the output from the structured partial input model 120.

[0059] In the case of supervised learning, the output of the structured partial input model 120 is a numerical value between 0 and 1 (y' ＳＵＰ The structured partial loss calculation unit 140 calculates the loss l' ＳＵＰ the model output y' ＳＵＰ and the label t, the calculation is performed using the following formula:

[0060] l' ＳＵＰ =f' ＳＵＰ (y' ＳＵＰ , t) f' ＳＵＰ (y' ＳＵＰ , t) represents a loss function. As the loss function, for example, the cross entropy error expressed by the following formula is used.

[0061] f' ＳＵＰ (y' ＳＵＰ ,t)=-{tlogy' ＳＵＰ +(1-t)log(1-y' ＳＵＰ In the case of unsupervised learning, for example, the structured partial input model 120 is trained to output a reconstruction of the input. The output is a vector (y' ＵＮ The structured partial loss calculation unit 140 calculates the loss l' ＵＮ the model output y' ＵＮ and the input to the model (denoted as x') are used to calculate using the following formula:

[0062] l' ＵＮ =f' ＵＮ (y' ＵＮ , x) f' ＵＮ (y' ＵＮ , x) represents a loss function. For example, the squared error shown below is used as the loss function.

[0063] f' ＵＮ (y' ＵＮ , x)=(y' ＵＮ -x) ２ The learning unit 180 trains the structured partial input model 120 as a loss l′ ＳＵＰ Or loss l' ＵＮ That is, the parameters of the structured partial input model 120 are adjusted.

[0064] (Regarding Anomaly Degree Calculation) Next, the anomaly degree calculation will be described. Fig. 10 is a diagram showing the functional units used in the anomaly degree calculation and the input and output of each functional unit in the anomaly degree calculation. As shown in Fig. 10, the anomaly degree calculation uses an unstructured partial input model 110, a structured partial input model 120, and an anomaly degree calculation unit 150. Both the unstructured partial input model 110 and the structured partial input model 120 have already been trained.

[0065] Furthermore, when a loss function is used, the unstructured partial loss calculation unit 130 and the structured partial loss calculation unit 140 are used. Note that the anomaly degree calculation unit 150 may include the functions of the unstructured partial loss calculation unit 130 and the structured partial loss calculation unit 140.

[0066] The operation of the configuration shown in FIG. 10 will be described along the steps of the flowchart in FIG.

[0067] <S201: Input> In S201, the template portion of the test data is input to the unstructured portion input model 110, and the structured portion of the test data is input to the structured portion input model 120.

[0068] <S202: Model Output> In S202, the unstructured partial input model 110 outputs y ＳＵＰ Or y ＵＮ Or y ＴＥＭＰ and the structured partial input model 120 outputs y' ＳＵＰ Or y' ＵＮ Output y ＳＵＰ Or y ＵＮ Or y ＴＥＭＰ is input to the abnormality degree calculation unit 150, and y' ＳＵＰ Or y' ＵＮ is input to the abnormality degree calculation unit 150.

[0069] <S203: Calculation of Abnormality Degree> In S203, the abnormality degree calculation unit 150 calculates the abnormality degree A based on the model output in S202. Specifically, this is as follows.

[0070] When the unstructured partial input model 110 and the structured partial input model 120 are supervised learning models, the anomaly degree calculation unit 150 calculates the output y ＳＵＰ and the output y′ from the structured partial input model 120 ＳＵＰ Using these, the abnormality degree A is calculated using the following formula.

[0071] A = αy ＳＵＰ +βy' ＳＵＰ When the unstructured partial input model 110 and the structured partial input model 120 are unsupervised learning models, the anomaly degree calculation unit 150 calculates the output y ＵＮ and the output y′ from the structured partial input model 120 ＵＮ Using the loss function for and, calculate the degree of anomaly A using the following formula.

[0072] A = αf ＵＮ (y ＵＮ , x) + βf' ＵＮ (y' ＵＮ , x) Furthermore, when the unstructured partial input model 110 and the structured partial input model 120 are unsupervised learning models, the anomaly degree calculation unit 150 calculates the output y ＴＥＭＰ and the output y′ from the structured partial input model 120 ＵＮ The degree of anomaly A may be calculated using the following formula using a loss function for

[0073] A = αf ＴＥＭＰ (y ＴＥＭＰ , E １ , E ２ ) + βf' ＵＮ (y' ＵＮ , x) where α and β are real numbers equal to or greater than 0 (where αβ ≠ 0) and are determined using verification data before calculating the degree of anomaly using a method described below. For anomaly detection, an arbitrary threshold is determined in advance, and an anomaly is determined when the degree of anomaly A exceeds the threshold. The anomaly degree calculation unit 150 may have an anomaly determination function using the threshold.

[0074] The unstructured part often contains important information for anomaly detection, so it is desirable to use it as input, but when only the unstructured part is used as input, the detection accuracy decreases due to the difficulty of handling the text.

[0075] In contrast, the technology according to this embodiment can correct the degree of anomaly by weighting and adding together the output of a model that takes the unstructured portion as input and the output of a model that takes the structured portion as input, or by weighting and adding together the loss function for the output of a model that takes the unstructured portion as input and the loss function for the output of a model that takes the structured portion as input, thereby preventing a decrease in detection accuracy.

[0076] (Method of Determining Parameters) Next, a method of determining the parameters α and β will be described. Fig. 12 is a diagram showing functional units used in determining α and β, and the inputs and outputs of each functional unit.

[0077] 12 , the determination of α and β uses an unstructured partial input model 110, a structured partial input model 120, an unstructured partial loss calculation unit 130, a structured partial loss calculation unit 140, and an anomaly degree calculation parameter determination unit 160. Both the unstructured partial input model 110 and the structured partial input model 120 have already been trained.

[0078] The operation of the configuration shown in FIG. 12 will be described along the steps of the flowchart in FIG.

[0079] <S301: Input> In S301, the template portion of the verification data is input to the unstructured portion input model 110, and the structured portion of the verification data is input to the structured portion input model 120.

[0080] <S302: Model Output> In S302, the unstructured partial input model 110 outputs y ＳＵＰ Or y ＵＮ Or y ＴＥＭＰ and the structured partial input model 120 outputs y' ＳＵＰ Or y' ＵＮ Output y ＳＵＰ Or y ＵＮ Or y ＴＥＭＰis input to the unstructured partial loss calculation unit 130, and y' ＳＵＰ Or y' ＵＮ is input to the structured partial loss calculation unit 140.

[0081] <S303: Loss Calculation> In S303, the unstructured portion loss calculation unit 130 calculates the loss l ＳＵＰ Or loss l ＵＮ Or loss l ＴＥＭＰ The loss calculated by the unstructured partial loss calculation unit 130 is hereinafter referred to as l.

[0082] Furthermore, the structured partial loss calculation unit 140 calculates the loss l' ＳＵＰ Or loss l' ＵＮ The loss calculated by the structured partial loss calculation unit 140 is hereinafter referred to as l'.

[0083] The processes of S301 to S303 are executed for all the verification data.

[0084] <S304: Parameter Calculation> In S304, the anomaly degree calculation parameter determination unit 160 calculates the sum L of the losses l of the unstructured parts in all the verification data. Ｖ Calculate the sum of the losses l' of the structured parts L' Ｖ Calculate L Ｖ and L' Ｖ Using this, α and β are calculated using the following formula.

[0085] The abnormality degree calculation parameter determination unit 160 may calculate α and β using the following formula.

[0086] Furthermore, when the unstructured partial input model 110 and the structured partial input model 120 are supervised learning models, the anomaly degree calculation parameter determination unit 160 may determine α and β in the following manner.

[0087] First, the anomaly degree calculation parameter determination unit 160 determines the output y ＳＵＰ , the output y′ from the structured partial input model 120 ＳＵＰ , label t, and an arbitrary threshold value TH, the number of data items that meet the conditions is found from among all the verification data items for each of the following conditions. TP and the like indicate the number of data items.

[0088] ・TP:y ＳＵＰ ≧TH and t=1 FP:y ＳＵＰ ≧TH and t=0 TN:y ＳＵＰ <TH and t=0 FN:y ＳＵＰ <TH and t=1 TP':y' ＳＵＰ ≧TH and t=1 FP':y' ＳＵＰ ≧TH and t=0 TN':y' ＳＵＰ <TH and t=0 FN':y' ＳＵＰ <TH and t=1 The anomaly calculation parameter determination unit 160 selects the accuracy rate, recall rate, precision rate, specificity, F-measure, etc. that can be calculated using the above values ​​and sets α and β as follows:

[0089]

[0090]

[0091]

[0092]

[0093]

[0094]

[0095]

[0096]

[0097]

[0098] Note that α and β may be set to arbitrary values ​​without using verification data. For example, if emphasis is placed on the results of the unstructured portion, α=0.6 and β=0.4 may be set.

[0099] (Other Configuration Examples) The learning function and the inference function may be separate devices. Alternatively, a separate device may be provided for determining the anomaly degree calculation parameters. Alternatively, the database 170 may be provided externally to the device.

[0100] 14 shows an example of the configuration of a learning device 200 for performing learning. As shown in Fig. 14, the learning device 200 includes an unstructured partial input model 110, a structured partial input model 120, an unstructured partial loss calculation unit 130, a structured partial loss calculation unit 140, and a learning unit 180. The unstructured partial input model 110 and the structured partial input model 120 trained by the learning device 200 are used in the inference device 300 and the parameter determination device 400.

[0101] Fig. 15 shows a configuration example of an inference device 300 that performs inference (calculation of anomaly degree). As shown in Fig. 15, the inference device 300 has an unstructured partial input model 110, a structured partial input model 120, an unstructured partial loss calculation unit 130, a structured partial loss calculation unit 140, and anomaly degree calculation unit 150. Note that when a supervised learning model is used, the unstructured partial loss calculation unit 130 and the structured partial loss calculation unit 140 may not be provided.

[0102] 16 shows an example of the configuration of a parameter determination device 400 that determines parameters. As shown in Fig. 16, the parameter determination device 400 includes an unstructured partial input model 110, a structured partial input model 120, an unstructured partial loss calculation unit 130, a structured partial loss calculation unit 140, an anomaly degree calculation unit 150, and an anomaly degree calculation parameter determination unit 160.

[0103] (Hardware Configuration Example) Any of the devices described in this embodiment (log anomaly detection device 100, learning device 200, inference device 300, and parameter determination device 400) can be realized, for example, by causing a computer to execute a program. This computer may be a physical computer or a virtual machine on the cloud.

[0104] That is, the device can be realized by executing a program corresponding to the processing performed by the device using hardware resources such as a CPU and memory built into a computer. The program can be recorded on a computer-readable recording medium (such as a portable memory) and stored or distributed. The program can also be provided via a network such as the Internet or email.

[0105] Fig. 17 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 17 includes a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, and the like, all of which are interconnected via a bus B. The computer may further include a GPU.

[0106] The program that realizes the processing on the computer is provided by a recording medium 1001, such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0107] The memory device 1003 reads and stores a program from the auxiliary storage device 1002 when an instruction to start the program is received. The CPU 1004 realizes functions related to the device in accordance with the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network, etc. The display device 1006 displays a GUI (Graphical User Interface) or the like according to the program. The input device 1007 is composed of a keyboard, mouse, buttons, a touch panel, etc., and is used to input various operation instructions. The output device 1008 outputs the results of calculations.

[0108] (Effects of the embodiment) As described above, the technology described in the present embodiment uses not only the unstructured part of the log but also the structured part as input for log anomaly detection, thereby suppressing the decrease in accuracy of anomaly detection due to the effects of parsing failures that occur when only the unstructured part of the log is used, and improving the accuracy of anomaly detection.

[0109] The following additional notes are provided regarding the above-described embodiments.

[0110] <Additional Notes> (Additional Item 1) An inference device comprising: a first model that takes an unstructured portion of a log as input and calculates a first output; a second model that takes a structured portion of the log as input and calculates a second output; and an anomaly degree calculation unit that calculates a weighted sum of the first output and the second output as an anomaly degree. (Additional Item 2) An inference device comprising: a first model that takes an unstructured portion of a log as input and calculates a first output; a second model that takes a structured portion of the log as input and calculates a second output; a first loss calculation unit that calculates a first loss from the first output; a second loss calculation unit that calculates a second loss from the second output; and an anomaly degree calculation unit that calculates a weighted sum of the first loss and the second loss as an anomaly degree. (Additional Item 3) The inference device according to Additional Item 1 or 2, wherein weight parameters used in the weighted sum are calculated using the first output calculated by the first model and the second output calculated by the second model. (Supplementary Item 4) A learning device comprising: a first model that takes an unstructured portion of a log as input and calculates a first output; a second model that takes a structured portion of the log as input and calculates a second output; a first loss calculation unit that calculates a first loss from the first output; a second loss calculation unit that calculates a second loss from the second output; and a learning unit that trains the first model so as to minimize the first loss, and trains the second model so as to minimize the second loss.

[0111] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims.

[0112] REFERENCE SIGNS LIST 100 Log anomaly detection device 110 Unstructured partial input model 120 Structured partial input model 130 Unstructured partial loss calculation unit 140 Structured partial loss calculation unit 150 Anomaly degree calculation unit 160 Anomaly degree calculation parameter determination unit 170 Database 200 Learning device 300 Inference device 400 Parameter determination device 1000 Drive device 1001 Recording medium 1002 Auxiliary storage device 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input device 1008 Output device

Claims

1. An inference device comprising: a first model that takes an unstructured portion of a log as input and calculates a first output; a second model that takes a structured portion of the log as input and calculates a second output; and an anomaly degree calculation unit that calculates a weighted sum of the first output and the second output as an anomaly degree.

2. An inference device comprising: a first model that takes an unstructured portion of a log as input and calculates a first output; a second model that takes a structured portion of the log as input and calculates a second output; a first loss calculation unit that calculates a first loss from the first output; a second loss calculation unit that calculates a second loss from the second output; and an anomaly calculation unit that calculates a weighted sum of the first loss and the second loss as an anomaly.

3. An inference device as described in claim 1 or 2, wherein the weight parameters used in the weighted sum are calculated using the first output calculated by the first model and the second output calculated by the second model.

4. A learning device comprising: a first model that takes an unstructured portion of a log as input and calculates a first output; a second model that takes a structured portion of the log as input and calculates a second output; a first loss calculation unit that calculates a first loss from the first output; a second loss calculation unit that calculates a second loss from the second output; and a learning unit that trains the first model to minimize the first loss and trains the second model to minimize the second loss.

Images