LSTM Neural Network Training for Dynamic Log Template Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing DeepLog model for anomaly detection in computer application logs requires a fixed and representative set of log templates, which can be undermined by unrepresentative training sets and source code changes, affecting its accuracy.
Innovation Solution
A method is introduced to dynamically determine the size of the set of distinct log templates by using a log file parser to generate clusters, which are then fed as a hyperparameter to an LSTM neural network for training, allowing the model to adapt to changes in source code and improve accuracy over time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If a fixed set of log templates is used to initialize the DeepLog model, then the model can be initialized with known hyperparameters, but the model accuracy is undermined by unrepresentative training sets and source code changes
Solution Approach 1:
The patent transforms the static, fixed set of log templates into a dynamic structure that automatically adapts to source code changes. The system continuously updates the set of distinct log templates by parsing new source code and identifying changes, allowing the model to maintain accuracy despite evolving software systems.
Solution Approach 2:
The patent implements a feedback mechanism where the system monitors source code changes and automatically updates the log template set accordingly. This feedback loop ensures that the model receives accurate and up-to-date information about the application's log patterns, maintaining high accuracy in anomaly detection.
2Ease of manufacture
If the value of |K| (number of log template classes) is known beforehand, then the LSTM model can be properly initialized, but the value cannot be determined without a sufficiently representative training set
Solution Approach 1:
The patent performs preliminary action by automatically parsing source code before model training to identify and extract the set of distinct log templates. This preliminary extraction of log template information ensures that the training set is representative and that the value of |K| can be accurately determined before initialization, eliminating the need for manual specification.
3Adaptability or versatility
If source code changes occur, then the application evolves, but the fixed set of log templates becomes outdated and reduces model performance
Solution Approach 1:
The patent ensures continuity of useful action by implementing continuous monitoring and updating of the log template set. The system continuously parses source code changes, identifies new or modified log templates, and updates the training set accordingly. This continuous adaptation process maintains high anomaly detection accuracy as the application evolves over time.
Data Source
AI summary
A method for training a neural network utilizing Long Short-Term Memory (LSTM) to model a computer application log as a natural language sequence comprises feeding a training set of application log files to a log file parser, generating, by the log file parser, a set of X application log clusters, where X is a whole number, feeding the whole number X to an untrained LSTM neural network as a hyperparameter representing a number of classes, and training the untrained LSTM neural network using the training set of log files and the hyperparameter X to obtain a trained LSTM neural network.