KR20210011822A - Method of detecting abnormal log based on artificial intelligence and system implementing thereof - Google Patents

Abstract

The present invention relates to a method for detecting an abnormal log based on artificial intelligence and a system implementing the same. A system for detecting an abnormal log based on artificial intelligence according to an embodiment of the present invention comprises: a log collector which collects log data computed during an operation of the system; a data pre-processing unit which pre-processes and vectorize the collected log data to generate structured log data; an AI engine which automatically labels data by clustering the structured log data and classifies the labeled data into normal log data and abnormal log data; a black filter which compares the normal log data with a blacklist and reclassifies some of the normal log data as abnormal log data; and a white filter which reclassifies some of the abnormal log data as normal log data by comparing the abnormal log data with a white list. The present invention can detect the abnormal log data and can automatically check the error status of the system.

Description

Artificial intelligence-based abnormal log detection method and system implementing it {METHOD OF DETECTING ABNORMAL LOG BASED ON ARTIFICIAL INTELLIGENCE AND SYSTEM IMPLEMENTING THEREOF}

The present invention relates to a method of detecting an abnormal log based on artificial intelligence and a system implementing the same.

In a computer system or a network system, data such as a log is generated in response to each operation. These data show what actions have occurred in the system or what errors have occurred.

However, these data are unstructured data that the system outputs as text composed of specific letters and numbers. Therefore, in order to analyze a log, there is a method in which a person manually checks the log or retrieves a specific log by searching with a keyword.

However, when various logs are generated or the number of generated logs is large, there is a limit to manual log analysis. Therefore, we will look at a method and apparatus for processing and classifying data such as logs and selecting and processing only important contents.

An object of the present invention is to provide a system and method capable of automatically checking an error condition of a system by detecting abnormal log data.

It is an object of the present invention to automatically classify various types of log data generated in various systems to increase the efficiency of detecting anomalies of the system.

The problem to be solved by the present invention is not limited to the problems mentioned above, and other problems not mentioned herein will be clearly understood by those skilled in the art from the following description.

The system for detecting abnormal logs based on artificial intelligence according to an embodiment of the present invention includes a log collector that collects log data calculated during the operation of the system, and generates standardized log data that is vectorized by preprocessing the collected log data. The data preprocessor and the AI engine that automatically label the data by clustering the standardized log data and classify it into normal and abnormal log data, and the normal log data and blacklist are compared to make some of the normal log data abnormal. It includes a black filter for reclassifying as log data and a white filter for reclassifying some of the abnormal log data as normal log data by comparing abnormal log data and white list.

The method of detecting abnormal logs based on artificial intelligence according to an embodiment of the present invention includes the steps of a log collector collecting log data calculated during the operation of the system, and a data preprocessing unit preprocessing and vectorizing the collected log data. Generate log data, the AI engine clusters the standardized log data to automatically label the data and classify it into normal and abnormal log data, and a black filter compares normal log data and blacklist. And reclassifying some of the normal log data as abnormal log data, and reclassifying some of the abnormal log data as normal log data by comparing the abnormal log data with the white list by the white filter.

When implementing the present invention, abnormal log data can be detected to automatically check an error condition of the system.

When implementing the present invention, it is possible to automatically classify various types of log data generated in various systems to increase the efficiency of detecting anomalies of the system.

The effects provided by the present invention are not limited to the above-mentioned effects, and other effects not mentioned herein will be clearly understood by those skilled in the art from the following description.

1 shows the overall work flow according to an embodiment of the present invention.
2 shows the configuration of a system according to an embodiment of the present invention.
3 shows a learning process according to an embodiment of the present invention.
4 shows a process of detecting an abnormality in log data by the system according to an embodiment of the present invention.
5 shows an analysis process according to an embodiment of the present invention.
6 shows a process of processing log data according to an embodiment of the present invention.
7 shows an example of updating a blacklist according to an embodiment of the present invention.

Advantages and features of the present invention, and a method of achieving them will become apparent with reference to the embodiments described below in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be implemented in a variety of different forms, only these embodiments make the disclosure of the present invention complete, and common knowledge in the technical field to which the present invention pertains. It is provided to completely inform the scope of the invention to those who have, and the invention is only defined by the scope of the claims. The same reference numerals refer to the same elements throughout the specification.

In order to clearly describe the present invention, parts irrelevant to the description have been omitted, and the same reference numerals are assigned to the same or similar components throughout the specification. In addition, some embodiments of the present invention will be described in detail with reference to exemplary drawings. In adding reference numerals to elements of each drawing, the same elements may have the same numerals as possible even if they are indicated on different drawings. In addition, in describing the present invention, when it is determined that a detailed description of a related known configuration or function may obscure the subject matter of the present invention, a detailed description thereof may be omitted.

In addition, in describing the constituent elements of the present invention, terms such as first, second, A, B, (a), (b) may be used. These terms are only for distinguishing the component from other components, and the nature, order, order, or number of the component is not limited by the term. When a component is described as being "connected", "coupled" or "connected" to another component, the component may be directly connected or connected to that other component, but other components between each component It is to be understood that is "interposed", or that each component may be "connected", "coupled" or "connected" through other components.

In the embodiment of the present invention, a description will be given focusing on log data as an example of unstructured data. Log data refers to data generated to leave a certain error, state change, or operation result during system operation. That is, information on certain actions (processes) left by the system or each of the components constituting the system, the occurrence of a specific event, and the occurrence of errors are all left as log data, and the system operator can check this.

In this specification, in order to solve the problem of human monitoring and evaluation of log data, which is a vast amount of unstructured data accumulated in the system, an artificial intelligence (AI)-based abnormal log detection system is provided. In more detail, in order to detect abnormal logs based on artificial intelligence, the system of the present specification may select a blacklist by clustering unstructured log data.

When applying the embodiment of the present invention, by selecting and providing only log lines that may lead to problems in the operating system, the number of lines that must be analyzed by humans is reduced, and suspicious activity of the system is recorded through the log. You can check it quickly.

That is, when the embodiment of the present invention is applied, the system promptly presents a log corresponding to a system problem or a result of a problem, thereby reducing the effort required for log file analysis and the fatigue of human analysis.

The log abnormality detection system is a general-purpose system that can be applied to logs generated in any system such as WAS (Web Application Server), Web application, and Database (DB). Therefore, it is possible to detect anomalies by learning log source data as it is by minimizing data preprocessing without information on the domain of a system in a specific field.

An abnormal log or abnormal log is based on a rare data set that does not occur frequently, and a new log or a rare log that did not appear in the past or that did not occur frequently in the past is used as an embodiment.

Hereinafter, a process of detecting anomalies in unstructured data based on artificial intelligence will be described. As an example of unstructured data, we look around log data.

1 shows the overall work flow according to an embodiment of the present invention. To detect anomalies based on artificial intelligence, a learning process is first required. To this end, the system collects log data (S1) and preprocesses the log data in order to appropriately convert the log data so that it can be applied to learning and abnormality detection (S2).

Thereafter, the preprocessed log data is learned using machine learning. Machine learning deployed in a system that detects log abnormalities or in a separate system receives log data and performs learning (S3). A fully trained machine learning network can be deployed in the system.

After that, the sufficiently learned system analyzes the log data input thereafter to detect whether there is an abnormality (S4). And after detecting the abnormality, the analysis is performed (S5). The analysis includes the process of checking whether an actual problem situation has occurred in response to a log that has been identified as abnormal, or whether a problem situation has occurred even though the log was not identified as abnormal. These can be done automatically on the system, the results from which are fed back into the machine learning network, and the machine learning network can perform retraining or complementary learning.

2 shows the configuration of a system according to an embodiment of the present invention.

The log collector 200 collects logs generated by various devices. The log collector 200 may collect logs from all computers included in a case where one system includes a plurality of computers. In addition, if the system includes one computer, logs generated in that computer can be collected.

The log collector 200 may be disposed outside the system 100 or may be disposed inside the system 100.

Log source data generated from the system 100 or a WAS, web application, DB, etc. operating on a plurality of computers in the system are collected by the log collector 200, which is a collection engine, and stored in the data lake 110.

The scheduler 120 fetches log data from the data lake 110 by executing scheduling at each learning cycle set by a user or preset in the system for learning of the system. In addition, when the system 100 performs real-time detection, log data generated in real time is fetched every minute or at a specific time and transmitted to the data queue 130.

In this case, the scheduler 120 may add information indicating whether the data to be transmitted is for learning or for real-time detection (for example, a distinguishable ID) to the data and transmit it to the data queue 130. The data queue 130 is used as a pipeline for transmitting data for learning and real-time data.

When log data for system learning is introduced, the data preprocessor 145 fetches the data and performs preprocessing to vectorize the log string. For example, the data preprocessor 145 performs minimal preprocessing such as removing a time attribute such as a time information field in which a log has occurred, and a process of vectorizing a log string. In other words, it performs a task of formalizing unstructured log data suitable for learning or detection.

When the log data for system training is introduced, the Training Manager 141 fetches the data and performs preprocessing to vectorize the log string through the data preprocessor 145, and then machine learning through the AI engine 150. Automatic data labeling is performed using the clustering technique of

The training manager 141 learns and generates a classification model through supervised learning by taking the labeled data and previous training data stored in the data mart 190. The automatically labeled data is stored in the data mart 190 to be used in the next learning cycle.

Since the generated log is related to the recent log, not all past data is used for training. It only uses data from the last few days or at least several months and can be set automatically by the system. Alternatively, the above-described setting may be manually set by a user or an analyst.

When a log generated in real time is introduced, the serving manager 143 performs preprocessing to vectorize a log string through the data preprocessor 145 and detects an abnormal log through the classification model of the AI engine 150. A threshold filter (163) is applied to filter values whose prediction score is less than the set threshold, and detected after removing the ones classified as abnormal but not abnormal through a white filter (165). The abnormal log is stored in the data mart 190 and a notification is delivered to the user through the dashboard 180.

The AI engine 150 includes a learning model and performs the following two functions, clustering and classification. Clustering uses Machine Learning Clustering as an embodiment. Clustering means clustering log data with similar patterns.

In this process, a cluster that is not included in any cluster or is rare is labeled as "abnormal" and whitelist filtering is performed through a white filter 165.

The rest of the data is labeled "normal", and the "normal" data is filtered through a black filter (161).

All labeled data is stored in the data mart 190.

The classification model performs classification using deep learning. The AI engine 150 applies Deep Learning supervised Classification to train a model for classifying anomalous logs by combining automatically labeled data through clustering and previously labeled data stored in a data mart. And create a model. The creation of the model can consist of software modules and can be deployed on different systems.

The black filter 161 extracts a log related to a problem, that is, an abnormal state from data classified as normal. The blacklist, which is the result of the extraction, is automatically created in the system in advance or created in a database by the user/analyst, and means logs that must be found. The black filter 161 performs an operation of filtering a black list from'normal' data of the training data.

In addition, the black filter 161 may automatically update the black filter.

A white filter 165 filters a white list included in the detected abnormal log. A white list is a log that is automatically created in the system or created in a database by an analyst/user in advance, and is not judged as an abnormal log. In addition, the white filter 165 may automatically update the white filter.

A threshold filter 163 filters logs below a specific score by setting a threshold value on a prediction score for how accurately the learning model predicts. This is to prevent excessive notifications cut by false positives along with the white filter.

The Rest API 170 communicates with the dashboard 1800 through a specific protocol, and transmits and receives user requests or data generated by the system. The protocol uses the HTTP protocol as an embodiment.

The configuration of FIG. 2 is summarized as follows. The system of FIG. 2 may optionally include a log collector 200 that collects log data calculated during operation of the system. In addition, the data preprocessing unit 145 pre-processes the collected log data to generate a vectorized form of log data. The AI engine 150 automatically labels the data by clustering the standardized log data and classifies it into normal log data and abnormal log data.

In addition, the black filter 161 compares the normal log data and the black list to reclassify some of the normal log data as abnormal log data, and the white filter 165 compares the abnormal log data and the white list to determine some of the abnormal log data. Reclassify as normal log data.

3 shows a learning process according to an embodiment of the present invention. S1, S2, S3 of Figure 1 is presented in more detail.

Look at the data collection step (S11). The system collects log data for learning from raw data that continues to accumulate until before or even now (S11). For this, it includes a method of taking data for learning from a data lake 110 in which log data as a source is accumulated.

That is, there are two types of log collection methods of the log collector 200: a method of taking log data every preset learning period, and a method of taking data in real time for real-time detection. Both methods may be performed by the operation of the scheduler 120. The S11 process is also applied when real-time log data is collected in the subsequent detection process.

Next, a data preprocessing step (S12) will be described. In addition to the learning process of FIG. 3, the data preprocessor 145 operates in a detection process to be described later. The preprocessor 145 extracts the data transmitted by the scheduler 120 through the queue 130 to perform minimal preprocessing and a process of vectorizing a log string.

Then the learning phase begins. The AI engine 150 clusters log data that has undergone data preprocessing using a machine learning clustering technique (S13).

In addition, the AI engine 150 labels the log data as “abnormal” (abnormal log data) in case the log data is outlier or sparse pattern (S14, S17). On the other hand, if the log data is neither an outlier nor a sparse pattern, the AI engine 150 labels it as "normal" (normal log data) (S14, S15).

Since the amount of logs is vast, the system automatically performs labeling of log data through clustering without manually adding "normal" or "abnormal" labels.

Here, as an example of determining the outlier/sparse pattern, clustering may be performed as follows. If log data does not belong to any cluster, or if the density or composition ratio of the cluster is less than a certain size (for example, 5%) of the total data, the AI engine 150 determines the log as an abnormal log and labels each log as "abnormal". Add And add "normal" label to the rest of the log.

Here, the system, in more detail, the white filter 165 may add log data constituting a cluster having the highest density or composition ratio in the entire standardized log data to the white list. For example, if there is log data that is repeatedly calculated in a large number over all of the standardized log data, the log data is added to the white list.

When configuring a cluster among all log data, if the similarity between log data in the cluster is high, the system may determine that the cluster has a high density. Alternatively, the cluster consisting of log data that is most frequently calculated among all log data is likely to be log data irrelevant to the occurrence of errors. Thus, the white filter can add these log data to the whitelist.

In addition, after S15, the system 100 filters the blacklist by applying the black filter 161 to the "normal" data (S16). The blacklist is a list of abnormal logs that must be detected.

In addition, after S17, the system 100 filters the white list by applying the white filter 165 to the "abnormal" data (S18). The white list is a log list that is not considered an abnormal log.

S13 to S17 may be repeatedly performed for each log data.

Thereafter, the system 100 extracts and integrates the previously stored labeling data from the data mart 190 (S19). In addition, the labeling data is newly stored in the data mart 190 (S20).

The system 100 supervises learning a classification model with the labeled data and generates a model (S21, S22). In addition, the system 100 can store the labeled data in the data mart 190 and use it for the next learning.

4 shows a process of detecting an abnormality in log data by the system according to an embodiment of the present invention.

Also in the detection step, the above-described real-time log data collection (S31) and data preprocessing and vectorization (S32) are performed. The system 100 pre-processes log data generated in real time and then detects an abnormal log through the classification model generated in the learning step (S33, S34).

The detected abnormal log is filtered in two stages. The system 100 filters data having a prediction score value less than or equal to the threshold value by applying the previously set prediction score threshold (S35). The prediction score is a score for how accurately the model predicted the abnormal log. The range has a minimum value-a maximum value, and may be set from a minimum of 0 to a maximum of 1 in an embodiment.

Next, the system 100 filters whitelisted data from the detected data (S36). The white list is a log list that is not considered abnormal. The system 100 stores abnormal (abnormal) log data remaining after passing all filtering in the data mart 190 (S37), and notifies the user through the dashboard 180 (S38).

For example, the data mart 190 may store a detection result finally output as abnormal log data after filtering in real time or at a predetermined time interval.

Real-time detection is a process of determining whether log data generated in real time is abnormal log data or normal log data using an AI engine that includes a classification model that has already been learned.

Accordingly, the log collector 200 may collect log data from raw data accumulated in real time. In addition, the threshold filter 163 calculates a probability that the classified log data is related to an abnormal state of the system by calculating a predicted score of log data.

That is, the classification model of the AI engine 150 receives standardized log data and outputs whether it is abnormal log data. In addition, the filtered result according to the prediction score calculated by the threshold filter 163 is stored as a detection result. The stored detection result is stored in the data mart 190 so that a monitoring person in charge can visually check it through the dashboard 180.

5 shows an analysis process according to an embodiment of the present invention.

When an abnormal log is detected in the process of FIG. 4, a notification is generated through the dashboard 180 (S41), and the system analyzes the abnormal log (S42). That is, the system 100 may find the cause of the system problem and take action through the detected log.

In addition, the system 100 may create a white list of logs that can be ignored from the detected logs, and a black list of logs that must be detected.

For example, if a white log is included in the abnormal log (S43), it is added to the white list (S44). The white log is a log at a point in time that has been identified as an abnormal log but no actual error or problem situation has occurred in the system, and the system 100 may determine this as a white log and add it to the white list.

In addition, for a log when a problem occurs or an error occurs in the system, the system 100 determines the log (black log) as a black log even if it is confirmed in FIG. 4 that it is not an abnormal log (S45). ). Then, the system 100 adds the black log to the blacklist, labels it as "abnormal" and stores it in the data mart 190 (S46).

In the process of FIG. 5, the log indicating the problem situation can be more clearly identified, and as the analysis process is repeated, the logs added to the data mart 190 as blacklists become more precise, thereby increasing the accuracy of anomaly detection. .

When the above-described embodiments are applied, the system 100 may automatically label each log data without additional data on a domain to which the system generating the log belongs during supervised learning. In the process of training the model of the AI engine, it is possible to quickly process a large variety of logs into "normal"/"abnormal".

In addition, the system 100 stores the automatically labeled training data in the data mart 190 and accumulates the training data. For this reason, the accuracy of anomaly detection can be increased as the training data increases in the deep learning process.

In addition, the system can add the missing abnormal log data by providing various filters 161, 163, and 165, and it is possible to prevent unnecessary notification of normal log data.

6 shows a process of processing log data according to an embodiment of the present invention. Raw log (51) refers to log data generated by the system. It can be stored in a certain database or can be created in the form of a file. Log data may be input in a data pre-processing process in real time 51b or in a batch method 51a.

As an embodiment of the data pre-processing process (S52), the data pre-processing unit 145 vectorizes log data by embedding a word constituting log data in a vector space. In an embodiment, the data preprocessor 145 may apply the Word2Vec algorithm.

The log data vectorized in step S52 is clustered by the AI engine 150 (S53). Clustering automates the task of labeling training data for supervised learning in machine learning.

In addition, an embodiment of the clustering process of S53 uses the K-Means algorithm and clusters similar log data by measuring similarity between log data based on NLP (Natural Language Processing). The similarity can be calculated by using the Euclidean distance between vectors of log data.

In addition, in the clustering process, each cluster is referred to as a cluster, and clusters can be classified into two types. That is, the AI engine 150 regards a sparse cluster, that is, a log group that does not appear frequently, as an abnormal log. And the log data included in the sparse cluster is labeled as "abnormal". In addition, the AI engine 150 labels log data included in a cluster other than a rare cluster as "normal".

When the pattern classification and automatic labeling of S53 are completed, machine learning is performed (S54). In this process, a filtering process may be temporarily performed (S55). Filtering may automatically apply a black filter and a white filter as described above. Alternatively, only the black filter can be applied automatically.

For example, if the log is classified as "normal" but has a high similarity to the log included in the predetermined blacklist 60, it is reclassified as "abnormal". Or, if an error occurs when the log is created in the system, it is also reclassified as "abnormal".

Conversely, if the log is classified as "abnormal" but has high similarity to the log included in the predetermined white list, it is reclassified as "normal". Or, if there was a normal operation before or after the log was created in the system, it is also reclassified as "normal".

The machine learning process supervises DNN (deep neural network) with training data having two classes, "abnormal" and "normal" created through clustering.

When learning is completed, detection (S56) is performed. Detection is performed using log information generated and vectorized in S52, and the log is input to the learning network learned in S54 to calculate whether it is abnormal or normal.

In this process, scoring (S57) is performed, and the predicted score of the model is used for detection scoring. The Threshold Filter detects a log in which the confidence score of the log detected by the detection model is higher than a preset threshold.

Meanwhile, the blacklist 60 may include "abnormal" logs provided in advance according to the system. Alternatively, when a problem occurs during the operation of the system, if it is not a plainly output log among the logs output before and after, it may be included in the blacklist.

Even if the logs included in the blacklist are classified as "normal" during the clustering process, the noise of the class classified as "normal" is improved by reclassifying them as "abnormal".

The blacklist can be updated in real time. In other words, since logs calculated before and after the occurrence of an abnormal situation are highly likely to be problematic log data, intermittently calculated logs are automatically added to the blacklist, not those that normally occur among them.

Also, among logs calculated as "normal" in the clustering step, a similarity degree is compared to see if there is a log included in the blacklist, and a log with the same or high similarity is set to "abnormal".

On the other hand, whitelists can also be automatically created. For example, the system prints out on a regular basis and can retain information about logs that it generates in a normal state. Accordingly, logs corresponding to normal operation are added to the white list, and log data detected as abnormal logs is then compared with the white list, and logs having the same or high similarity are set to "normal".

In addition, the similarity criterion may be set differently for a blacklist and a whitelist. For example, the blacklist reclassifies some of "normal" as "abnormal", and the degree of similarity when the blacklist is applied is called BLACK_PRO. That is, the black filter 161 may set a similarity reference value for reclassifying by comparing log data with logs included in the blacklist as BLACK_PRO.

The black filter 161 determines that the log data is different from the log included in the blacklist when the similarity calculated by comparing the log data with the log included in the blacklist is lower than BLACK_PRO.

In addition, the whitelist reclassifies some of the "abnormal" as "normal", and the degree of similarity when the whitelist is applied is called WHITE_PRO. That is, the white filter 165 may set a similarity reference value for reclassifying by comparing log data with logs included in the white list as WHITE_PRO.

The white filter 165 determines that the log data is different from the log included in the white list when the similarity calculated by comparing the log data with the log included in the white list is lower than WHITE_PRO.

The system can keep BLACK_PRO to have a lower value than WHITE_PRO. Because for the stability of the system, reclassifying some of the "normal" as "abnormal" (BLACK_PRO) makes it easier to configure, and reclassifying some of the "abnormal" as "normal" (WHITE_PRO) is more difficult. Configuration to increase the possibility of coping with problem situations as much as possible.

In addition, according to another embodiment, when there are too many logs classified as "abnormal", BLACK_PRO may be maintained at a higher or equal level than WHITE_PRO for system efficiency.

The black filter 161 filters the "normal" data by applying a black list. The blacklist can be automatically generated or added.In one embodiment, in the scoring step, the predicted score of the model is 0.999 (the threshold can be set according to the system, and can be set strictly to a value close to 1) or higher. Is saved as a blacklist. This blacklist is used to remove noise contained in the "normal" class in the process of labeling the training data.

The blacklist filtering process is as follows. In the clustering step, check if there are any logs included in the blacklist among logs included in the cluster classified as "normal". Similarity can be calculated by comparing sentences or comparing key words. And if the log is the same or has high similarity, the log is labeled as "abnormal" data.

And the final scoring result is output through the interface on the system (S58). This allows the user to check or be used in the monitoring process.

7 shows an example of updating a blacklist according to an embodiment of the present invention.

Arrows in FIG. 7 indicate a time flow in which the system or various devices constituting the system operate. In this process, an abnormal situation occurs at the time t1. In this case, logs generated before or after a predetermined time from the time point t1 may be candidates for the blacklist.

That is, in other words, the log data is included in the blacklist based on the abnormal situation of the system occurring before or after a certain time based on the time at which the log data was calculated.

Therefore, among the log data generated between t0 and t2, the log data remaining excluding log data that is clearly classified as normal log data is set as a blacklist candidate. If an abnormal situation occurs even after that, redundant log data among log data already included in the blacklist candidate can be added to the blacklist.

Therefore, the update of the blacklist is 1) log data that is not normal log data among log data generated when an abnormal situation occurs, and 2) log data that is repeatedly calculated when an abnormal situation occurs may be included in the blacklist.

In addition, the system, in more detail, the black filter 161, when determining whether the individual log data is abnormal, and when the log data, which is an outlier, is calculated at a time similar to that of the abnormal situation of the system/device, the black filter 161 blacklists for system stability. You can add the log data to.

Even if all the constituent elements constituting the embodiments of the present invention are described as being combined or combined into one operation, the present invention is not necessarily limited to these embodiments, and all constituent elements within the scope of the present invention are one or more. It can also be selectively combined and operated. In addition, although all of the components may be implemented as one independent hardware, a program module that performs some or all functions combined in one or more hardware by selectively combining some or all of the components. It may be implemented as a computer program having Codes and code segments constituting the computer program may be easily inferred by those skilled in the art. Such a computer program is stored in a computer-readable storage medium, and is read and executed by a computer, thereby implementing an embodiment of the present invention. The storage medium of the computer program includes a magnetic recording medium, an optical recording medium, and a storage medium including a semiconductor recording element. In addition, the computer program implementing the embodiment of the present invention includes a program module that is transmitted in real time through an external device.

It should be understood that the above-described embodiments are illustrative and non-limiting in all respects, and the scope of the present invention will be indicated by the claims to be described later rather than the detailed description described above. And the meaning and scope of the claims, as well as all transformable and deformable forms derived from the equivalent concept should be interpreted as being included in the scope of the present invention.

100: system
110: data lake
120: scheduler
130: data queue
145: data preprocessor
150: AI engine
161: black filter
165: white filter

Claims (12)

A log collector for collecting log data calculated during the operation of the system;
A data preprocessing unit that pre-processes the collected log data to generate a vectorized form of log data;
An AI engine that automatically labels the data by clustering the standardized log data and classifies it into normal log data and abnormal log data;
A black filter for reclassifying some of the normal log data as abnormal log data by comparing the normal log data with a black list; And
A system for detecting abnormal logs based on artificial intelligence, comprising a white filter for reclassifying some of the abnormal log data as normal log data by comparing the abnormal log data with a white list.
The method of claim 1,
The log collector collects log data from the accumulated raw data every preset learning period,
The AI engine labels outliers as abnormal log data in the standardized log data, labels other log data as normal log data, and then supervises learning a classification model using the labeled data. A system that detects logs.
The method of claim 2,
The white filter is a system for detecting abnormal logs based on artificial intelligence that adds log data constituting a cluster having the highest density or composition ratio among the standardized log data to the white list.
The method of claim 1,
The black filter includes the log data in the blacklist based on an abnormal situation of a system occurring before or after a predetermined time based on a time at which the log data is calculated. A system for detecting abnormal logs based on artificial intelligence.
The method of claim 1,
The log collector collects log data from raw data accumulated in real time,
Further comprising a threshold filter for calculating the predicted score of the log data,
The classification model of the AI engine receives the standardized log data and outputs whether it is abnormal log data, and
A system for detecting an abnormal log based on artificial intelligence that stores the filtered result as a detection result according to the prediction score calculated by the threshold filter.
The method of claim 1,
The black filter sets a similarity reference value for reclassifying by comparing the log data with the logs included in the blacklist as BLACK_PRO,
The white filter sets a similarity reference value for reclassifying by comparing the log data with the logs included in the white list as WHITE_PRO,
The system sets the value of BLACK_PRO to a value lower than the value of WHITE_PRO. A system for detecting an abnormal log based on artificial intelligence.
Collecting, by a log collector, log data calculated during operation of the system;
Generating, by a data preprocessing unit, the collected log data and vectorized standardized log data;
An AI engine clustering the standardized log data to automatically label the data and classify it into normal log data and abnormal log data;
Reclassifying some of the normal log data as abnormal log data by comparing the normal log data with a black list by a black filter; And
And reclassifying some of the abnormal log data as normal log data by comparing the abnormal log data with a white list by a white filter.
The method of claim 7,
The log collector collecting log data from the accumulated raw data every preset learning period; And
The AI engine labels outliers as abnormal log data in the standardized log data, labels other log data as normal log data, and supervises learning a classification model using the labeled data. , Artificial intelligence-based anomalous log detection method.
The method of claim 8,
The method of detecting an abnormal log based on artificial intelligence, further comprising the step of adding, by the white filter, log data constituting a cluster having the highest density or composition ratio among the standardized log data to the white list.
The method of claim 7,
The black filter further comprises the step of including the log data in the blacklist based on an abnormal situation of the system occurring before or after a predetermined time based on the time when the log data was calculated, artificial intelligence-based abnormal log How to detect.
The method of claim 7,
The log collector collecting log data from raw data accumulated in real time;
Calculating, by a threshold filter, a prediction score of the log data;
Receiving the standardized log data and outputting whether the classification model of the AI engine is abnormal log data; And
The data mart further comprises the step of storing the filtered result as a detection result according to the prediction score calculated by the threshold filter.
The method of claim 7,
The black filter comparing the log data with the logs included in the black list and reclassifying the similarity reference value as BLACK_PRO;
The white filter comparing the log data with the log included in the white list and reclassifying the similarity reference value is set to WHITE_PRO; And
The system sets the value of BLACK_PRO to a value lower than the value of WHITE_PRO. Method for detecting an abnormal log based on artificial intelligence.

Images