Abnormality detection model training method, anomaly detection method, anomaly detection device and medium

Abstract

The invention provides an anomaly detection model training method, an anomaly detection method, an anomaly detection device and a medium. The anomaly detection model training method comprises the steps that log data used for training are obtained, non-structural data are extracted from the log data, and the non-structural data comprise text data and numerical data. The text data is converted into word vectors, and the data type data is converted into vectors; and inputting the word vectors and the vectors into a random forest model for training, and adjusting parameters of the random forest model to obtain an anomaly detection model. Through the above method, the non-structural data belonging to the server system operation information in the log data used for training is extracted to train the random forest model, so that the obtained anomaly detection model can quickly distinguish normal data from abnormal data and reduce the interference of invalid information, thereby improving the training efficiency.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an anomaly detection model training method, an anomaly detection method, a device and a medium. Background technique [0002] Anomaly detection is the process of finding the "minority", the outlier data that is brought to our attention because it is not like the majority. By obtaining abnormal data, it is helpful to discover potential problems such as structural defects and equipment failures related to the server system. Timely anomaly detection helps system developers (or operators) locate problems in a timely manner and resolve them immediately, thereby reducing system downtime. [0003] During system operation, logs are usually generated to record detailed operating information of the system during operation. Therefore, logs can be used as the main data source for abnormal detection of the system. [0004] In related technologies, when performing anomaly detection ...

AI Technical Summary

Problems solved by technology

[0006] Therefore, the technical problem to be solved by the present invention is to overcome the defects of low efficiency and low accuracy of anomaly detection for system logs in the prior art, thereby providing an anomaly detection model training method, anomaly detection method, device and medium

Images