Generative adversarial network-based system log-level anomaly detection algorithm

doi:10.11772/j.issn.1001-9081.2020020270

Journal of Computer Applications ›› 2020, Vol. 40 ›› Issue (10): 2960-2966.DOI: 10.11772/j.issn.1001-9081.2020020270

• Cyber security • Previous Articles Next Articles

Generative adversarial network-based system log-level anomaly detection algorithm

XIA Bin^1,2, BAI Yuxuan¹, YIN Junjie³

1. School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing Jiangsu 210023, China;
2. Jiangsu Key Laboratory of Big Data Security&Intelligent Processing;(Nanjing University of Posts and Telecommunications), Nanjing Jiangsu 210023, China;
3. Zhongxing Telecommunication Equipment Corporation, Nanjing Jiangsu 210012, China

Received:2020-03-12 Revised:2020-04-18 Online:2020-10-10 Published:2020-05-15
Supported by:
This work is partially supported by the National Natural Science Foundation of China (61802205), the Natural Science Foundation of Jiangsu Higher Education Institutions (18KJB520037).

基于生成对抗网络的系统日志级异常检测算法

夏彬^1,2, 白宇轩¹, 殷俊杰³

1. 南京邮电大学计算机学院、软件学院、网络空间安全学院, 南京 210023;
2. 江苏省大数据安全与智能处理重点实验室(南京邮电大学), 南京 210023;
3. 中兴通讯股份有限公司, 南京 210012

通讯作者: 殷俊杰
作者简介:夏彬(1989-),男,江苏南京人,讲师,博士,CCF会员,主要研究方向:智能运维、推荐系统、深度学习;白宇轩(1995-),男,山西晋中人,硕士研究生,主要研究方向:深度学习、自然语言处理;殷俊杰(1994-),男,江苏人南京人,高级工程师,硕士,主要研究方向:推荐系统、深度学习。
基金资助:
国家自然科学基金资助项目（61802205）；江苏省高校自然科学研究项目（18KJB520037）。

Abstract

Abstract: To solve the problems of small number of anomaly samples and inefficient feedback of anomalies in the anomaly detection tasks of large-scale software system, a log-level anomaly detection algorithm based on Generative Adversarial Network (GAN) and attention mechanism. First, the unstructured logs were converted into structured events through the log templates, and each event included timestamps, signature and parameters. Second, through sliding window method, the sequence of the parsed events were divided into patterns, and the real training dataset was comprised combination of the divided event patterns and the corresponding following events. Third, the real event patterns were used as the training samples to train the attention mechanism-based GAN, and the Recurrent Neural Network (RNN) based generator was trained through the adversarial learning mechanism until it converged. Finally, through the input flow event pattern, the generator generated the possibility distribution of normal and abnormal events based on the previous pattern. When the threshold was set, whether the specific log of next moment is a normal event or an abnormal event was determined automatically. Experimental results show that the proposed anomaly detection algorithm, which uses a gated recurrent unit network as the attention weight and a Long Short-Term Memory (LSTM) network to fit event patterns, has a 21.7% increase in precision compared to the algorithm only using the gated recurrent unit network. In addition, compared to the log-level anomaly detection algorithm LogGAN, the proposed algorithm improves the precision of anomaly detection by 7.8% over the performance of LogGAN.

Key words: anomaly detection, Generative Adversarial Network (GAN), attention mechanism, Recurrent Neural Network (RNN), artificial intelligence for IT operations

摘要： 针对大规模软件系统自动化异常检测任务中异常样本过少且异常反馈不及时的问题，提出一种基于生成对抗网络（GAN）与注意力机制的日志级异常检测算法。首先，通过日志模板将非结构化的日志转化为结构化的事件，每一个事件包含了日志的时间戳、签名与变量。其次，以滑动窗口的方式划分解析的事件序列，将产生的事件模式与下一时刻的事件组成真实的数据样本集。然后，将真实的事件模式作为训练样本输入来训练基于注意力机制的生成对抗网络，通过对抗学习的机制训练基于循环神经网络（RNN）的生成器直至收敛。最后，生成器通过输入的流式事件模式生成在新到来的事件模式下的正常与异常事件分布，并在系统管理员设置阈值的情况下，自动判断下一时刻的特定日志为正常事件或是异常事件。实验结果表明，提出的以门控循环单元网络为注意力权重并且用长短时记忆（LSTM）网络来解析事件模式的异常检测算法，比仅使用门控循环单元网络时的算法精准率提高了21.7%；此外，与日志级异常检测算法LogGAN相比，所提算法比LogGAN的异常检测精准率提升了7.8%。

关键词: 异常检测, 生成对抗网络, 注意力机制, 循环神经网络, 智能运维

CLC Number:

TP391.4

XIA Bin, BAI Yuxuan, YIN Junjie. Generative adversarial network-based system log-level anomaly detection algorithm[J]. Journal of Computer Applications, 2020, 40(10): 2960-2966.

夏彬, 白宇轩, 殷俊杰. 基于生成对抗网络的系统日志级异常检测算法[J]. 计算机应用, 2020, 40(10): 2960-2966.

References

[1] ZHU J,HE S,LIU J,et al. Tools and benchmarks for automated log parsing[C]//Proceedings of the IEEE/ACM 41st International Conference on Software Engineering:Software Engineering in Practice. Piscataway:IEEE,2019:121-130.
[2] DU M,LI F. Spell:streaming parsing of system event logs[C]//Proceedings of the IEEE 16th International Conference on Data Mining. Piscataway:IEEE,2016:859-864.
[3] HE P,ZHU J,ZHENG Z,et al. Drain:an online log parsing approach with fixed depth tree[C]//Proceedings of the 2017 IEEE International Conference on Web Services. Piscataway:IEEE, 2017:33-40.
[4] GUO S,LIU Z,CHEN W,et al. Event extraction from streaming system logs[C]//Proceedings of the 2018 International Conference on Information Science and Applications,LNEE 514. Singapore:Springer,2018:465-474.
[5] HE S,ZHU J,HE P,el al. Experience report:system log analysis for anomaly detection[C]//Proceedings of the IEEE 27th International Symposium on Software Reliability Engineering. Piscataway:IEEE,2016:207-218.
[6] 胡珉, 白雪, 徐伟, 等. 多维时间序列异常检测算法综述[J]. 计算机应用,2020,40(6):1553-1564.(HU M,BAI X,XU W,et al. Review of anomaly detection algorithms for multidimensional time series[J]. Journal of Computer Applications,2020,40(6):1553-1564.)
[7] CHEN M,ZHENG A X,LLOYD J,et al. Failure diagnosis using decision trees[C]//Proceedings of the 1st International Conference on Autonomic Computing. Piscataway:IEEE,2004:36-43.
[8] LIANG Y,ZHANG Y,XIONG H,el al. Failure prediction in IBM BlueGene/L event logs[C]//Proceedings of the 7th IEEE International Conference on Data Mining. Piscataway:IEEE, 2007:583-588.
[9] BODIK P,GOLDSZMIDT M,FOX A,et al. Fingerprinting the datacenter:automated classification of performance crises[C]//Proceedings of the 5th European Conference on Computer Systems. New York:ACM,2010:111-124.
[10] 仇媛, 常相茂, 仇倩, 等. 基于长短期记忆网络和滑动窗口的流数据异常检测方法[J]. 计算机应用,2020,40(5):1335-1339. (QIU Y,CHANG X M,QIU Q,et al. Stream data anomaly detection method based on long short-term memory and sliding window[J]. Journal of Computer Applications,2020,40(5):1335-1339.)
[11] BREUNIG M M, KRIEGEL H P, NG R T, et al. LOF:identifying density-based local outliers[C]//Proceedings of the 2000 ACM SIGMOD International Conference on Management of Data. New York:ACM,2000:93-104.
[12] XU W,HUANG L,FOX A,et al. Detecting large-scale system problems by mining console logs[C]//Proceedings of the 22nd ACM Symposium on Operating Systems Principles. New York:ACM,2009:117-132.
[13] LIN Q,ZHANG H,LOU J,et al. Log clustering based problem identification for online service systems[C]//Proceedings of the 38th International Conference on Software Engineering Companion. New York:ACM,2016:102-111.
[14] 李海林, 邬先利. 基于频繁模式发现的时间序列异常检测方法[J]. 计算机应用,2018,38(11):3204-3210.(LI H L,WU X L. Time series anomaly detection method based on frequent pattern discovery[J]. Journal of Computer Applications,2018,38(11):3204-3210.)
[15] LIU F T,TING K M,ZHOU Z. Isolation forest[C]//Proceedings of the 8th IEEE International Conference on Data Mining. Piscataway:IEEE,2008:413-422.
[16] LOU J,FU Q,YANG S,et al. Mining invariants from console logs for system problem detection[C]//Proceedings of the 2010 USENIX Annual Technical Conference. Berkeley,CA:USENIX Association,2010:1-14.
[17] DU M,LI F F,ZHENG G N,et al. DeepLog:anomaly detection and diagnosis from system logs through deep learning[C]//Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. New York:ACM,2017:1285-1298.
[18] XIA B, YIN J, XU J, et al. LogGAN:a sequence-based generative adversarial network for anomaly detection based on system logs[C]//Proceedings of the 2019 International Conference on Science of Cyber Security,LNCS 11933. Cham:Springer,2019:61-76.
[19] GOODFELLOW I. NIPS 2016 tutorial:generative adversarial networks[EB/OL].[2020-01-11]. https://arxiv.org/pdf/1701.00160.pdf.
[20] MIKOLOV T,CHEN K,CORRADO G,et al. Efficient estimation of word representations in vector space[EB/OL].[2020-01-11]. https://arxiv.org/pdf/1301.3781.pdf.

Generative adversarial network-based system log-level anomaly detection algorithm

基于生成对抗网络的系统日志级异常检测算法

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 15

Recommended Articles

Metrics

[1]	DAI Yurou, YANG Qing, ZHANG Fengli, ZHOU Fan. Trajectory prediction model of social network users based on self-supervised learning [J]. Journal of Computer Applications, 2021, 41(9): 2545-2551.
[2]	LIU Yaxuan, ZHONG Yong. Joint extraction method of entities and relations based on subject attention [J]. Journal of Computer Applications, 2021, 41(9): 2517-2522.
[3]	LIU Zichen, LI Xiaojuan, WEI Wei. Automatic patent price evaluation based on recurrent neural network [J]. Journal of Computer Applications, 2021, 41(9): 2532-2538.
[4]	LI Kangkang, ZHANG Jing. Multi-layer encoding and decoding model for image captioning based on attention mechanism [J]. Journal of Computer Applications, 2021, 41(9): 2504-2509.
[5]	ZHAO Hong, KONG Dongyi. Chinese description of image content based on fusion of image feature attention and adaptive attention [J]. Journal of Computer Applications, 2021, 41(9): 2496-2503.
[6]	HU Tianjie, HU Wenjun, WANG Shitong. Distribution entropy penalized support vector data description [J]. Journal of Computer Applications, 2021, 41(8): 2212-2218.
[7]	DANG Weichao, LI Tao, BAI Shangwang, GAO Gaimei, LIU Chunxia. Real-time remaining life prediction method of Web software system based on self-attention-long short-term memory network [J]. Journal of Computer Applications, 2021, 41(8): 2346-2351.
[8]	GUAN Qijie, ZHANG Ting, LI Deya, ZHOU Shaojing, DU Yi. Indefinite reconstruction method of spatial data based on multi-resolution generative adversarial network [J]. Journal of Computer Applications, 2021, 41(8): 2306-2311.
[9]	SUN Xiao, XU Jindong. Remote sensing image dehazing method based on cascaded generative adversarial network [J]. Journal of Computer Applications, 2021, 41(8): 2440-2444.
[10]	DING Yin, SANG Nan, LI Xiaoyu, WU Feizhou. Prediction method of capacity data in telecom industry based on recurrent neural network [J]. Journal of Computer Applications, 2021, 41(8): 2373-2378.
[11]	WU Wei, LI Zeping, YANG Huawei, LIN Chuan, WANG Zhongde. Deep attention video popularity prediction model fusing content features and temporal information [J]. Journal of Computer Applications, 2021, 41(7): 1878-1884.
[12]	LI Chao, LAN Hai, WEI Xian. Attention-based object detection with millimeter wave radar-lidar fusion [J]. Journal of Computer Applications, 2021, 41(7): 2137-2144.
[13]	LI Yangzhi, YUAN Jiazheng, LIU Hongzhe. Human skeleton-based action recognition algorithm based on spatiotemporal attention graph convolutional network model [J]. Journal of Computer Applications, 2021, 41(7): 1915-1921.
[14]	ZHANG Yang, JIANG Minghu. Authorship identification of text based on attention mechanism [J]. Journal of Computer Applications, 2021, 41(7): 1897-1901.
[15]	GAO Qinquan, HUANG Bingcheng, LIU Wenzhe, TONG Tong. Bamboo strip surface defect detection method based on improved CenterNet [J]. Journal of Computer Applications, 2021, 41(7): 1933-1938.