The invention relates to a log sequence
anomaly detection framework based on nLSTM-
self attention, and the framework comprises a training model and an
anomaly detection model. The training model comprises: assuming that one log file contains k log templates E = {e1, e2L ek}, wherein the input of the training model is a sequence of the log template, the log sequence lt-h,...lt-2, lt-1 with the length of h comprises a log template li belongs to E, t-h < = i < = t-1, and the log template number | lt-h,...lt-2, lt-1 | in one sequence is equal to m < = h; enabling each log template to correspond toone template number, generating a log template dictionary, generating an input sequence from a normal log template sequence, and feeding the input sequence and target data into an
anomaly detection model for training. The detection stage comprises the following steps: the
data input method is the same as the training stage, anomaly detection is carried out by using the model generated in the training stage, the model output is a
probability vector P = (p1, p2L pk), pi represents the probability that the target log template is ei, if the actual target data is within the prediction value, it isjudged that the log sequence is normal, otherwise it is judged that the log sequence is abnormal.