摘要
为了解决词向量模型选择不当而导致的CNN日志异常检测性能下降问题,文中设计了基于CNN的日志异常检测模型,在预处理阶段采用不同词向量模型构建词向量字典,利用词向量字典将测试日志向量化并输入到CNN中,比较其各项性能指标以选择最优词向量模型提高CNN日志异常检测的性能表现。实验结果表明:当训练日志量较少时,不同词向量模型对应CNN的性能指标差异明显,其中GloVe模型使得CNN性能表现最优,分别在两种实验数据集上取得88.92和97.19最高F 1值。随着训练日志量的逐渐增加,不同词向量模型对应CNN的性能指标差异逐渐减小,GloVe模型使得CNN性能依然有最优表现。
Improper selection of word vector models may result in poor performance of CNN log anomaly detection.The paper presents a CNN based log anomaly detection model.At the preprocessing stage,different word vector models are used to construct word vector dictionaries,with which the test log is vectorized and input into CNN.By comparing the performance indicators of CNN,the optimal word vector model gets selected to improve the performance of CNN-based log anomaly detection.The experimental results show that for a small amount of the training log,the performance indexes of CNN corresponding to different word vector models vary significantly.The GloVe model makes the CNN perform best,with the highest F1 values of 88.92 and 97.19 obtained on the two experimental data sets respectively.With a gradual increase in the amount of training log,the difference of performance indicators of CNN corresponding to different word vector models is becoming smaller,and the GloVe model still makes the CNN perform best.
作者
杨光
闫谦时
容晓峰
YANG Guang;YAN Qianshi;RONG Xiaofeng(School of Computer Science and Engineering,Xi’an Technological University,Xi'an 710021,China)
出处
《西安工业大学学报》
CAS
2023年第6期578-587,共10页
Journal of Xi’an Technological University
基金
西安市未央区科技计划项目(202025)
中国兵器工业试验测试研究院开放课题基金项目(200911013)。
关键词
日志
词向量模型
卷积神经网络模型
异常检测
log
word vector model
Convolutional Neural Network(CNN)
anomaly detection