Log sequence anomaly detection framework based on nLSTM (Non-Log Sequence Transfer Module)-self attention

Abstract

The invention relates to a log sequence anomaly detection framework based on nLSTM-self attention, and the framework comprises a training model and an anomaly detection model. The training model comprises: assuming that one log file contains k log templates E = {e1, e2L ek}, wherein the input of the training model is a sequence of the log template, the log sequence lt-h,...lt-2, lt-1 with the length of h comprises a log template li belongs to E, t-h < = i < = t-1, and the log template number | lt-h,...lt-2, lt-1 | in one sequence is equal to m < = h; enabling each log template to correspond toone template number, generating a log template dictionary, generating an input sequence from a normal log template sequence, and feeding the input sequence and target data into an anomaly detection model for training. The detection stage comprises the following steps: the data input method is the same as the training stage, anomaly detection is carried out by using the model generated in the training stage, the model output is a probability vector P = (p1, p2L pk), pi represents the probability that the target log template is ei, if the actual target data is within the prediction value, it isjudged that the log sequence is normal, otherwise it is judged that the log sequence is abnormal.

Description

technical field [0001] The invention relates to network security technology, in particular to a log sequence anomaly detection framework based on nLSTM-self attention. Background technique [0002] The network environment is becoming more and more complex, and attacks against network applications and systems are constantly emerging, often using a combination of multiple attack methods, which makes the existing anomaly detection methods no longer applicable to new types of attacks. Once the attack is successful or the network application itself is abnormal, it will bring immeasurable losses to the owner and users of the application. The earlier attacks and bugs are discovered, the less damage will be caused. [0003] Networks, systems, and applications all generate logs during operation to record operating status and important events. Therefore, logs contain extremely rich dynamic information, and log analysis is crucial for maintaining various tasks. These tasks range from...

AI Technical Summary

Problems solved by technology

One-hot encoding input is used. In the abnormal detection part, a training and detection architecture based on 2-layer stacked LSTM (2LSTM is used below to represent 2-layer stacked LSTM) is used. Although it is better than machine learning methods in terms of accuracy on some data sets A great improvement has been achieved, but this architecture does not have a good effect on all data sets due to the lack of one-hot performance characteristics and the insufficient processing capacity of LSTM itself for longer sequences.

Images