云工作流中基于多任务时序卷积网络的异常检测方法

Anomaly detection method based on multi-task temporal convolutional network in cloud workflow

云计算数据中心在日常部署和运行过程中产生的大量日志可以帮助系统运维人员进行异常分析。路径异常和时延异常是云工作流中常见的异常。针对传统的异常检测方法分别对两种异常检测任务训练相应的学习模型,而忽略了两种异常检测任务之间的关联性,导致异常检测准确率下降的问题,提出了一种基于多任务时序卷积网络的日志异常检测方法。首先,基于日志流的事件模板,生成事件序列和时间序列;然后,训练基于多任务时序卷积网络的深度学习模型,该模型通过共享时序卷积网络中的浅层部分来从系统正常执行的流程中并行地学习事件和时间特征;最后,对云计算工作流中的异常进行分析,并设计了相关异常检测逻辑。在Open Stack数据集上的实验结果表明,与日志异常检测的领先算法Deep Log和基于主成分分析(PCA)的方法比较,所提方法的异常检测准确率至少提升了7.7个百分点。

Numerous logs generated during the daily deployment and operation process in cloud computing platforms help system administrators perform anomaly detection.Common anomalies in cloud workflow include pathway anomalies and time delay anomalies.Traditional anomaly detection methods train the learning models corresponding to the two kinds of anomaly detection tasks respectively and ignore the correlation between these two tasks,which leads to the decline of the accuracy of anomaly detection.In order to solve the problems,an anomaly detection method based on multi-task temporal convolutional network was proposed.Firstly,the event sequence and time sequence were generated based on the event templates of log stream.Then,the deep learning model based on the multi-task temporal convolutional network was trained.In the model,the event and the time characteristics were learnt in parallel from the normal system execution processes by sharing the shallow layers of the temporal convolutional network.Finally,the anomalies in the cloud computing workflow were analyzed,and the related anomaly detection logic was designed.Experimental results on the OpenStack dataset demonstrate that,the proposed method improves the anomaly detection accuracy at least by 7.7 percentage points compared to the state-of-art log anomaly detection algorithm DeepLog and the method based on Principal Component Analysis(PCA).