Event Topological Graph for Log Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern software systems are becoming increasingly complex, making it difficult for operation and maintenance personnel to accurately and efficiently detect anomalies in system logs due to their unstructured nature, which existing solutions fail to address effectively.
Innovation Solution
A method and apparatus for generating a topological graph by acquiring a preset event stream corresponding to a normal log execution path, determining dependent event pairs, and generating an event topological graph based on transfer intervals and probabilities, which is then used for anomaly detection in a to-be-detected event stream.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If system logs are used for anomaly detection, then valuable system status information can be obtained, but the unstructured nature of logs makes it difficult to locate anomalies accurately and efficiently
Solution Approach 1:
The patent segments the complex log data into structured event streams with defined schemas. Each log entry is parsed into standardized fields (event type, timestamp, source, etc.), transforming unstructured text into organized data units that can be systematically analyzed for anomaly detection.
Solution Approach 2:
The patent introduces a temporal dimension by constructing event topological graphs that model the time-ordered relationships between events. This transforms static log analysis into dynamic temporal pattern recognition, enabling detection of anomalies based on deviations from normal event sequences and time intervals.
2Reliability
If traditional log analysis methods are used, then system operations can be monitored, but anomaly detection accuracy is insufficient
Solution Approach 1:
The patent implements feedback mechanisms where the event topological graph continuously learns from observed event sequences. Normal event patterns are established as baseline models, and deviations from these patterns trigger anomaly detection, with results feeding back to refine the understanding of normal behavior over time.
Solution Approach 2:
The patent performs preliminary construction of event topological graphs during normal system operation to establish baseline event sequences and time intervals. This pre-learning phase creates reference models that enable rapid anomaly detection when deviations occur, without requiring complex real-time analysis of every log entry.
3Productivity
If operation and maintenance personnel manually analyze system logs, then system status can be understood, but the process is time-consuming and inefficient
Solution Approach 1:
The patent replaces manual mechanical analysis of logs with automated computational systems. Event streams are automatically parsed, topological graphs are constructed algorithmically, and anomalies are detected through automated comparison against learned patterns, eliminating the time-consuming manual review process while maintaining or improving detection accuracy.
Data Source
AI summary
Provided are a method and apparatus for generating a topological graph, an anomaly detection method and apparatus, a device and a storage medium. The method for generating a topological graph includes acquiring a preset event stream, where the preset event stream corresponds to a normal log execution path; determining a dependent event pair in the preset event stream; determining a range of a transfer interval corresponding to the dependent event pair, where a transfer interval represents the time difference between adjacent occurrences of two events in the dependent event pair; and generating an event topological graph according to the range of the transfer interval and the transfer probability corresponding to the dependent event pair, where the transfer probability represents the conditional probability between the two events in the dependent event pair.