计算机工程 ›› 2020, Vol. 46 ›› Issue (8): 50-57.doi: 10.19678/j.issn.1000-3428.0055553

• 人工智能与模式识别 • 上一篇    下一篇

基于改进时间卷积网络的日志序列异常检测

杨瑞朋1,2, 屈丹1, 朱少卫2, 钱叶魁2, 唐永旺1   

  1. 1. 中国人民解放军战略支援部队信息工程大学 信息系统工程学院, 郑州 450002;
    2. 中国人民解放军陆军炮兵防空兵学院(郑州校区), 郑州 450002
  • 收稿日期:2019-07-22 修回日期:2019-08-27 发布日期:2019-09-03
  • 作者简介:杨瑞朋(1985-),女,博士研究生,主研方向为智能信息处理、网络安全;屈丹,教授、博士、博士生导师;朱少卫,副教授、硕士;钱叶魁,副教授、博士;唐永旺,讲师、硕士。
  • 基金项目:
    国家自然科学基金面上项目(61673395)。

Anomaly Detection for Log Sequence Based on Improved Temporal Convolutional Network

YANG Ruipeng1,2, QU Dan1, ZHU Shaowei2, QIAN Yekui2, TANG Yongwang1   

  1. 1. School of Information System Engineering, PLA Strategic Support Force Information Engineering University, Zhengzhou 450002, China;
    2. PLA Army Academy of Artillery and Air Defense(Zhengzhou Campus), Zhengzhou 450002, China
  • Received:2019-07-22 Revised:2019-08-27 Published:2019-09-03

摘要: 基于循环神经网络的日志序列异常检测模型对短序列有较好的检测能力,但对长序列的检测准确性较差。为此,提出一种基于时间卷积网络的通用日志序列异常检测框架。将日志模板序列建模为自然语言序列,把基于神经网络训练的词嵌入作为模型的输入,以表示目标词在当前日志序列中的语义规则,并通过降维提高整个框架的运算效率。此外,提出用带参数的ReLU替换ReLU,用自适应平均池化层替换全连接层,将日志序列的异常检测问题建模成自然语言序列生成问题。实验结果表明,该检测框架的总体准确率高于TCN+Linear、TCN+AAP等方法。

关键词: 异常检测, 日志, 时间卷积网络, 激活函数, 自适应平均池化

Abstract: Existing anomaly detection models for log sequence based on recurrent neural network perform well for shorter sequences,but underperform for long sequences.To address the problem,this paper proposes a general anomaly detection framework for log sequences based on temporal convolutional networks.By modeling the log template sequence as a natural language sequence and using word embedding based on neural network training as the input of the model,the semantic rules of the target words in the current log sequence can be represented,and the computing efficiency of the whole framework can be improved by dimension reduction.In addition,which uses ReLU with parameters to replaces ReLU and uses adaptive average pooling layer to replace fully connected layer.The anomaly detection problem of log sequence is modeled as the natural language sequence generation problem.Experimental results show that the overall accuracy of the detection framework is higher than that of TCN+Linear,TCN+AAP and other methods.

Key words: anomaly detection, log, Temporal Convolutional Network(TCN), activation function, adaptive average pooling

中图分类号: