词向量模型对CNN日志异常检测的性能影响研究

Effect of Word Vector Models on the Performance of CNN Based Log Anomaly Detection

为了解决词向量模型选择不当而导致的CNN日志异常检测性能下降问题,文中设计了基于CNN的日志异常检测模型,在预处理阶段采用不同词向量模型构建词向量字典,利用词向量字典将测试日志向量化并输入到CNN中,比较其各项性能指标以选择最优词向量模型提高CNN日志异常检测的性能表现。实验结果表明:当训练日志量较少时,不同词向量模型对应CNN的性能指标差异明显,其中GloVe模型使得CNN性能表现最优,分别在两种实验数据集上取得88.92和97.19最高F 1值。随着训练日志量的逐渐增加,不同词向量模型对应CNN的性能指标差异逐渐减小,GloVe模型使得CNN性能依然有最优表现。

Improper selection of word vector models may result in poor performance of CNN log anomaly detection.The paper presents a CNN based log anomaly detection model.At the preprocessing stage,different word vector models are used to construct word vector dictionaries,with which the test log is vectorized and input into CNN.By comparing the performance indicators of CNN,the optimal word vector model gets selected to improve the performance of CNN-based log anomaly detection.The experimental results show that for a small amount of the training log,the performance indexes of CNN corresponding to different word vector models vary significantly.The GloVe model makes the CNN perform best,with the highest F1 values of 88.92 and 97.19 obtained on the two experimental data sets respectively.With a gradual increase in the amount of training log,the difference of performance indicators of CNN corresponding to different word vector models is becoming smaller,and the GloVe model still makes the CNN perform best.