首页|一种基于多特征的日志事件异常检测方法研究

一种基于多特征的日志事件异常检测方法研究

扫码查看
随着计算机系统规模增大、系统复杂性增加和用户服务质量要求提高,日志系统的重要性日益提高.日志用于记录计算机系统运行过程中产生的数据或事件,日志记录中的异常数据往往表明系统存在性能波动、异常或故障.针对现有的日志异常检测研究多采用单一特征进行异常检测,存在低效、不完备和误判率高等问题,提出基于多特征的日志事件异常检测方法.首先,定义了日志的多元特征,包括序列、定量、语义和时间特征.其次,采用BERT结合TF-IDF获取语义特征向量,并通过特征融合获取模型的输入特征.最后,建立基于注意力机制的Bi-LSTM异常检测模型.实验表明该异常检测模型在精确度上有一定提升,对于辅助发现日志异常具有一定参考作用.
Multi-feature-based log event anomaly detection
As computer systems grow in scale,complexity,and user demands for higher quality of service,the importance of logging systems has increased significantly.Logs are records of data or events generated during the operation of computer systems,and abnormal data in log entries often indicate per-formance fluctuations,anomalies,or failures within the system.Existing research on log anomaly de-tection mostly relies on a single feature,leading to issues such as inefficiency,incompleteness,and high misjudgment rates.This paper proposes a multi-feature-based approach for detecting anomalies in log e-vents.Firstly,we define the multi-dimensional features of logs,including sequential,quantitative,se-mantic,and temporal features.Secondly,we utilize BERT combined with TF-IDF to obtain semantic feature vectors and integrate these features to form the input for our model.Finally,we establish a Bi-LSTM anomaly detection model based on an attention mechanism.Experiments show that the proposed anomaly detection model achieves a certain improvement in accuracy,providing a valuable reference for assisting in the discovery of log anomalies.

anomaly detectionlog eventmulti-featuresattention mechanism

余佳妮、胡朝霞、蒋从锋

展开 >

杭州电子科技大学计算机学院,浙江杭州 310018

异常检测 日志事件 多元特征 注意力机制

2024

计算机工程与科学
国防科学技术大学计算机学院

计算机工程与科学

CSTPCD北大核心
影响因子:0.787
ISSN:1007-130X
年,卷(期):2024.46(9)