融合Transformer与1D-CNN的日志异常检测方法  

Log Anomaly Detection Method Integrating Transformer and 1D CNN

作　　者：赵海鹏 容晓峰[1] ZHAO Haipeng;RONG Xiaofeng(School of Computer Science and Engineering,Xi’an Technological University,Xi’an 710021,China)

机构地区：[1]西安工业大学计算机科学与工程学院,西安710021

出　　处：《西安工业大学学报》2025年第1期138-148,共11页Journal of Xi’an Technological University

基　　金：陕西省科技计划项目(2024JC-YBMS-502)。

摘　　要：为了解决现有日志异常检测方法在均衡日志序列的全局趋势和局部特征方面的不足,提出一种基于自编码器的无监督日志异常检测方法。该方法采用多层Transformer堆叠组成编码器,提取具备完整性和全局依赖性的多层融合特征,并通过1D-CNN与全连接神经网络构成的解码器聚焦数据的局部特征,重构输入数据。实验结果表明,该方法能够准确表示并识别数据特征,分别在三种公开数据集中取得99.7%、97.5%和96.4%的最高F 1值,较基准方法LogAnomaly平均提高7.9%。此外,通过消融实验验证了该方法在特征提取模块的有效性及其对实验结果的影响。For the shortcomings existing log anomaly detection methods have in balancing the global trends and local features of log sequences,this paper proposes an autoencoder based unsupervised log anomaly detection method.A multi layer Transformer stack is used as the encoder to extract multi layer fused features with completeness and global dependency.The decoder composed of 1D-CNN and fully connected neural networks is designed for capturing local features of the data to reconstruct the input data.Experimental results demonstrate that data features can be accurately represented and identified by this method,obtaining the highest F_(1) scores of 99.7%,97.5%,and 96.4%on three public datasets,respectively,an average increase of 7.9%compared with the baseline method,LogAnomaly.Additionally,ablation experiments were conducted to verified the effectiveness of the feature extraction module in the proposed method and its impact on the experimental results.

关 键 词：日志数据 异常检测 自编码器 TRANSFORMER 融合特征 

分 类 号：TP306[自动化与计算机技术—计算机系统结构]