云工作流中基于多任务时序卷积网络的异常检测方法

doi:10.11772/j.issn.1001-9081.2020091383

计算机应用 ›› 2021, Vol. 41 ›› Issue (6): 1701-1708.DOI: 10.11772/j.issn.1001-9081.2020091383

所属专题：网络空间安全

云工作流中基于多任务时序卷积网络的异常检测方法

姚杰¹, 程春玲¹, 韩静², 刘峥¹

1. 南京邮电大学计算机学院, 南京 210023;
2. 中兴通讯股份有限公司上海研发中心, 上海 201203

收稿日期:2020-09-07 修回日期:2020-12-17 出版日期:2021-06-10 发布日期:2020-12-29
通讯作者: 刘峥
作者简介:姚杰(1996-),男,江苏盐城人,硕士研究生,主要研究方向:日志分析、深度学习;程春玲(1972-),女,陕西西安人,教授,博士,主要研究方向:数据管理、资源管理和优化;韩静(1978-),女,上海人,高级工程师,硕士,主要研究方向:机器学习、事件挖掘;刘峥(1980-),男,江苏南京人,讲师,博士,CCF会员,主要研究方向:网络数据挖掘。
基金资助:
国家重点研发计划项目（2018YFB1003702）；中兴通讯股份有限公司产学研合作项目；南京邮电大学国家自然科学基金孵化项目（NY219084）。

Anomaly detection method based on multi-task temporal convolutional network in cloud workflow

YAO Jie¹, CHENG Chunling¹, HAN Jing², LIU Zheng¹

1. School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing Jiangsu 210023, China;
2. Shanghai Research and Development Center, Zhongxing Telecommunication Equipment Corporation, Shanghai 201203, China

Received:2020-09-07 Revised:2020-12-17 Online:2021-06-10 Published:2020-12-29
Supported by:
This work is partially supported by the National Key Research and Development Program of China (2018YFB1003702), the Industry-University-Research Cooperation Project of Zhongxing Telecommunication Equipment Corporation, the Incubation Project of National Natural Science Foundation of China from Nanjing University of Posts and Telecommunications (NY219084).

摘要/Abstract

摘要： 云计算数据中心在日常部署和运行过程中产生的大量日志可以帮助系统运维人员进行异常分析。路径异常和时延异常是云工作流中常见的异常。针对传统的异常检测方法分别对两种异常检测任务训练相应的学习模型，而忽略了两种异常检测任务之间的关联性，导致异常检测准确率下降的问题，提出了一种基于多任务时序卷积网络的日志异常检测方法。首先，基于日志流的事件模板，生成事件序列和时间序列；然后，训练基于多任务时序卷积网络的深度学习模型，该模型通过共享时序卷积网络中的浅层部分来从系统正常执行的流程中并行地学习事件和时间特征；最后，对云计算工作流中的异常进行分析，并设计了相关异常检测逻辑。在OpenStack数据集上的实验结果表明，与日志异常检测的领先算法DeepLog和基于主成分分析（PCA）的方法比较，所提方法的异常检测准确率至少提升了7.7个百分点。

关键词: 异常检测, 日志分析, 时序卷积网络, 多任务学习, 云工作流

Abstract: Numerous logs generated during the daily deployment and operation process in cloud computing platforms help system administrators perform anomaly detection. Common anomalies in cloud workflow include pathway anomalies and time delay anomalies. Traditional anomaly detection methods train the learning models corresponding to the two kinds of anomaly detection tasks respectively and ignore the correlation between these two tasks, which leads to the decline of the accuracy of anomaly detection. In order to solve the problems, an anomaly detection method based on multi-task temporal convolutional network was proposed. Firstly, the event sequence and time sequence were generated based on the event templates of log stream. Then, the deep learning model based on the multi-task temporal convolutional network was trained. In the model, the event and the time characteristics were learnt in parallel from the normal system execution processes by sharing the shallow layers of the temporal convolutional network. Finally, the anomalies in the cloud computing workflow were analyzed, and the related anomaly detection logic was designed. Experimental results on the OpenStack dataset demonstrate that, the proposed method improves the anomaly detection accuracy at least by 7.7 percentage points compared to the state-of-art log anomaly detection algorithm DeepLog and the method based on Principal Component Analysis (PCA).

Key words: anomaly detection, log analysis, temporal convolutional network, multi-task learning, cloud workflow

中图分类号:

TP183

姚杰, 程春玲, 韩静, 刘峥. 云工作流中基于多任务时序卷积网络的异常检测方法[J]. 计算机应用, 2021, 41(6): 1701-1708.

YAO Jie, CHENG Chunling, HAN Jing, LIU Zheng. Anomaly detection method based on multi-task temporal convolutional network in cloud workflow[J]. Journal of Computer Applications, 2021, 41(6): 1701-1708.

参考文献

[1] 陆杰, 李丰, 李炼. 分布式系统中的日志分析及应用[J]. 高技术通讯, 2019, 29(4):303-320.(LU J,LI F,LI L. Log analysis for distributed systems and its application[J]. High Technology Letters,2019,29(4):303-320.)
[2] 胡珉, 白雪, 徐伟, 等. 多维时间序列异常检测算法综述[J]. 计算机应用, 2020, 40(6):1553-1564.(HU M,BAI X,XU W,et al. Review of anomaly detection algorithms for multidimensional time series[J]. Journal of Computer Applications,2020,40(6):1553-1564.)
[3] 仇媛, 常相茂, 仇倩, 等. 基于长短期记忆网络和滑动窗口的流数据异常检测方法[J]. 计算机应用, 2020, 40(5):1335-1339.(QIU Y,CHANG X M,QIU Q,et al. Stream data anomaly detection method based on long short-term memory and sliding window[J]. Journal of Computer Applications,2020,40(5):1335-1339.)
[4] NGUYEN H,SHEN Z,TAN Y,et al. FChain:toward black-box online fault localization for cloud systems[C]//Proceedings of the 2013 IEEE 33rd International Conference on Distributed Computing Systems. Piscataway:IEEE,2013:21-30.
[5] WANG C. EbAT:online methods for detecting utility cloud anomalies[C]//Proceedings of the 2009 Middleware Doctoral Symposium. New York:ACM,2009:Article No. 4.
[6] 贾统, 李影, 吴中海. 基于日志数据的分布式软件系统故障诊断综述[J]. 软件学报, 2020, 31(7):1997-2018.(JIA T,LI Y,WU Z H. Survey of state-of-the-art log-based failure diagnosis[J] Journal of Software,2020,31(7):1997-2018.)
[7] XU W,HUANG L,FOX A,et al. Detecting large-scale system problems by mining console logs[C]//Proceedings of the 2009 ACM SIGOPS 22nd Symposium on Operating Systems Principles. New York:ACM,2009:117-132.
[8] CHEN M,ZHENG A X,LLOYD J,et al. Failure diagnosis using decision trees[C]//Proceedings of the 20041st International Conference on Autonomic Computing. Piscataway:IEEE,2004:36-43.
[9] LIANG Y,ZHANG Y,XIONG H,et al. Failure prediction in IBM BlueGene/L event logs[C]//Proceedings of the 2007 7th IEEE International Conference on Data Mining. Piscataway:IEEE, 2007:583-588.
[10] HE S,ZHU J,HE P,et al. Experience report:system log analysis for anomaly detection[C]//Proceedings of the 2016 IEEE 27th International Symposium on Software Reliability Engineering. Piscataway:IEEE,2016:207-218.
[11] YU X,JOSHI P,XU J,et al. CloudSeer:workflow monitoring of cloud infrastructures via interleaved logs[J]. ACM SIGARCH Computer Architecture News,2016,44(2):489-502.
[12] TAK B C,TAO S,YANG L,et al. LOGAN:problem diagnosis in the cloud using log-based reference models[C]//Proceedings of the 2016 IEEE International Conference on Cloud Engineering. Piscataway:IEEE,2016:62-67.
[13] NOVAES M P,CARVALHO L F,LLORET J,et al. Long shortterm memory and fuzzy logic for anomaly detection and mitigation in software-defined network environment[J]. IEEE Access, 2020,8:83765-83781.
[14] DU M,LI F,ZHENG G,et al. DeepLog:anomaly detection and diagnosis from system logs through deep learning[C]//Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. New York:ACM,2017:1285-1298.
[15] HOCHREITER S,SCHMIDHUBER J. Long short-term memory[J]. Neural Computation,1997,9(8):1735-1780.
[16] BROWN A,TUOR A,HUTCHINSON B,et al. Recurrent neural network attention mechanisms for interpretable system log anomaly detection[C]//Proceedings of the 20181st Workshop on Machine Learning for Computing Systems. New York:ACM,2018:1-8.
[17] LU S,WEI X,LI Y,et al. Detecting anomaly in big data system logs using convolutional neural network[C]//Proceedings of the 2018 IEEE 16th International Conference on Dependable, Autonomic and Secure Computing/the 16th International Conference on Pervasive Intelligence and Computing/the 4th International Conference on Big Data Intelligence and Computing and Cyber Science and Technology/the 3rd Cyber Science and Technology Congress. Piscataway:IEEE,2018:151-158.
[18] 王易东, 刘培顺, 王彬. 基于深度学习的系统日志异常检测研究[J]. 网络与信息安全学报, 2019, 5(5):105-118.(WANG Y D, LIU P S,WANG B. Research on system log anomaly detection based on deep learning[J]. Chinese Journal of Network and Information Security,2019,5(5):105-118.)
[19] MACMAHAN H B,HOLT G,SCULLEY D,et al. Ad click prediction:a view from the trenches[C]//Proceedings of the 2013 19th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. New York:ACM,2013:1222-1230.
[20] 任明, 宋云奎. 基于深度学习的云计算系统异常检测方法[J]. 计算机技术与发展, 2019, 29(5):54-57.(REN M,SONG Y K. Anomaly detection for cloud computing systems based on deep learning[J]. Computer Technology and Development,2019,29(5):54-57.)
[21] 杨瑞朋, 屈丹, 朱少卫, 等. 基于改进时间卷积网络的日志序列异常检测[J]. 计算机工程, 2020, 46(8):50-57.(YANG R P, QU D,ZHU S W,et al. Anomaly detection for log sequence based on improved temporal convolutional network[J]. Computer Engineering,2020,46(8):50-57.)
[22] 钟雅, 郭渊博. 基于机器学习的日志解析系统设计与实现[J]. 计算机应用, 2018, 38(2):352-356.(ZHONG Y,GUO Y B. Design and implementation of log parsing system based on machine learning[J]. Journal of Computer Applications,2018,38(2):352-356.)
[23] GUO S,LIU Z,CHEN W,et al. Event extraction from streaming system logs[C]//Proceedings of the 2018 International Conference on Information Science and Applications,LNEE 514. Singapore:Springer,2018:465-474.
[24] BAI S,KOLTER J Z,KOLTUN V. An empirical evaluation of generic convolutional and recurrent networks for sequence modeling[EB/OL].[2020-08-22]. https://arxiv.org/pdf/1803.01271.pdf.
[25] CARUANA R. Multitask learning[J]. Machine Learning,1997, 28(1):41-75.
[26] LONG M,CAO Z,WANG J,et al. Learning multiple tasks with multilinear relationship networks[C]//Proceedings of the 201731st International Conference on Neural Information Processing Systems. Red Hook:Curran Associates Inc.,2017:1594-1602.
[27] MISRA I,SHRIVASTAVA A,GUPTA A,et al. Cross-stitch networks for multi-task learning[C]//Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition. Piscataway:IEEE,2016:3994-4003.

云工作流中基于多任务时序卷积网络的异常检测方法

Anomaly detection method based on multi-task temporal convolutional network in cloud workflow

PDF

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 15

编辑推荐

Metrics

[1]	孟凡, 陈广, 王勇, 高阳, 高德群, 贾文龙. 基于多粒度时序结构表示的异常检测算法在储层含油性检测中应用[J]. 计算机应用, 2021, 41(8): 2453-2459.
[2]	胡天杰, 胡文军, 王士同. 分布熵惩罚的支持向量数据描述[J]. 计算机应用, 2021, 41(8): 2212-2218.
[3]	武国亮, 徐继宁. 基于命名实体识别任务反馈增强的中文突发事件抽取方法[J]. 计算机应用, 2021, 41(7): 1891-1896.
[4]	谢雨, 蒋瑜, 龙超奇. 基于随机子空间的扩展隔离林算法[J]. 计算机应用, 2021, 41(6): 1679-1685.
[5]	章荪, 尹春勇. 基于多任务学习的时序多模态情感分析模型[J]. 计算机应用, 2021, 41(6): 1631-1639.
[6]	李衍志, 范勇, 高琳. 基于形态流的石油钻井水流异常检测[J]. 计算机应用, 2021, 41(6): 1842-1848.
[7]	苟子安, 张晓, 吴东南, 王艳秋. 分布式存储系统中的日志分析与负载特征提取[J]. 计算机应用, 2020, 40(9): 2586-2593.
[8]	张晨曦, 唐曙, 唐珂. 迁移学习下的火箭发动机参数异常检测策略[J]. 计算机应用, 2020, 40(9): 2774-2780.
[9]	王磊. 改进粗糙集属性约简结合K-means聚类的网络入侵检测方法[J]. 计算机应用, 2020, 40(7): 1996-2002.
[10]	胡珉, 白雪, 徐伟, 吴秉键. 多维时间序列异常检测算法综述[J]. 计算机应用, 2020, 40(6): 1553-1564.
[11]	仇媛, 常相茂, 仇倩, 彭程, 苏善婷. 基于长短期记忆网络和滑动窗口的流数据异常检测方法[J]. 计算机应用, 2020, 40(5): 1335-1339.
[12]	阮灿华, 林甲祥. 动态事件时间数据的多任务Logistic生存预测方法[J]. 计算机应用, 2020, 40(5): 1284-1290.
[13]	霍纬纲, 王慧芳. 基于自编码器和隐马尔可夫模型的时间序列异常检测方法[J]. 计算机应用, 2020, 40(5): 1329-1334.
[14]	朱霖, 宁芊, 雷印杰, 陈炳才. 基于遗传算法选优的集成手段与时序卷积网络的涡扇发动机剩余寿命预测[J]. 计算机应用, 2020, 40(12): 3534-3540.
[15]	夏彬, 白宇轩, 殷俊杰. 基于生成对抗网络的系统日志级异常检测算法[J]. 计算机应用, 2020, 40(10): 2960-2966.