Industrial Machine Log Anomaly Detection Using Severity Histograms
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial machines generate massive, unlabeled, and unstructured log files with high token variety, making it difficult to accurately predict future anomalies and requiring significant human intervention, leading to inefficient and inaccurate error detection.
Innovation Solution
Transform log file messages into anomaly severity sequences, reducing the dimensionality from N-dimensional log tokens to M-dimensional anomaly severity levels, using large language models to predict future anomaly severity histograms, enabling efficient and accurate anomaly detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If next token prediction is used to predict future log tokens, then prediction accuracy can be achieved for short timescales, but the model size explodes and memory consumption becomes massive
Solution Approach 1:
The patent extracts only the essential anomaly severity information from the full log token sequence, transforming the prediction task from predicting all possible next tokens to predicting only the anomaly severity histogram. This extraction reduces the prediction space from N-dimensional token vocabulary to M-dimensional severity levels, dramatically reducing model size while maintaining prediction accuracy for anomaly detection.
Solution Approach 2:
The patent segments the log token prediction task into separate components: first classifying tokens into severity levels (M=5-10), then predicting the histogram distribution. This segmentation divides the complex N-dimensional token prediction into a simplified M-dimensional severity prediction, reducing computational complexity and model requirements.
2Measurement precision
If high token variety and specificity are used in log files, then detailed anomaly detection is possible, but prediction accuracy degrades over larger timescales
Solution Approach 1:
The patent changes the prediction parameter from specific log tokens to anomaly severity levels. By transforming the prediction target from detailed token sequences to aggregated severity histograms, the model can maintain accuracy over longer timescales while still capturing detailed anomaly information through the severity classification.
3Measurement precision
If supervised learning is used to train machine learning models, then training accuracy can be improved, but the process becomes cumbersome and requires massive labeled data
Solution Approach 1:
The patent enables the system to label its own data automatically by transforming log tokens into anomaly severity sequences using the learned model. This self-labeling mechanism eliminates the need for manual annotation of massive log datasets, allowing the system to train on its own generated labels without human intervention.
Data Source
AI summary
Abnormal behavior detection for industrial machines component(s) using large language models based on sequence(s) of log file messages recorded by logger(s) at initial time(s). The log file message sequence may be transformed into an anomaly severity sequence comprising log tokens encoding, times, and/or associated anomaly severity levels. The anomaly severity sequence may be input into the large language model. The large language model may output an anomaly severity histogram predicting M probabilities that the logger(s) will record log file messages encoded by log keys associated with M respective anomaly severity levels at the subsequent time(s). Abnormal behavior may be predicted based on the M probability patterns of the anomaly severity histogram. in the one or more components of the industrial machine logged by the one or more loggers at the one or more subsequent times. A control command may trigger automatically altering the component(s) operation to prevent the abnormal behavior.