JP2017146832A - Unusual log detection system and unusual log detection method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To detect an unusual log by reflecting characteristics of a series of log and determining similarity ratio of the series of log.SOLUTION: An unusual log detection system 1 comprises an extract unit 102, a calculation unit 103 and a detecting unit 104. The extract unit extracts two or more appointed lines of series of log from logs of an information system while sliding one line the top. The calculation unit counts a line count corresponding with other log series and makes log identity line count series while sliding one line the extracted one series of log, and calculates product of the area and the kurtosis of the made log identity line count series as a similarity ratio. The detecting unit detects unusualness of the series of log based on the calculated similarity ratio.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an abnormal log detection system and an abnormal log detection method.

  Various techniques using log information created and stored in an information system are known. For example, non-numeric information included in log data and a predetermined detection target pattern is converted into numerical information, a partial sequence in the detection target pattern converted into numerical information, and log data converted into numerical information There is known a technique for calculating the similarity of a partial sequence pair that is associated with a partial sequence in the file using a single score matrix based on dynamic programming (Patent Document 1). Also, it is known that normal models are collected from terminals, integrated to generate normal models, logs are analyzed using the normal models, and abnormalities indicating the degree of abnormalities in operations are calculated to detect abnormalities. (Patent Document 2).

JP 2011-138422 A JP2015-108898A

Toby Segaran, “Collective Intelligence Programming”, O'Reilly Japan, July 25, 2008, p.31-41 Yoshinori Uesaka and Kazuhiko Ozeki, “Pattern Recognition and Learning Algorithm”, Bunichi Sogo Shuppan, May 1990, p.91-108

  By the way, in anomaly detection using a log, it is considered useful if a normal state is learned through log monitoring and an abnormal log can be detected using the learned normal state.

  In this regard, a method of learning the log line by line can be considered as a method of detecting the abnormality of the log. However, when learning is performed by separating the logs line by line, it is not possible to detect a case in which an abnormal behavior appears in a series of logs extending over a plurality of lines.

  Further, as a method for comparing sequences, it is conceivable that sequences are represented by bag-of-words vectors, and similarity is determined based on the distance between sequences (Euclidean distance or cosine distance). However, in the bag-of-words vector, the distance between elements and the order of arrangement are not considered. On the other hand, the log series has regularity in the order of logs, and it can be said that the similarity is higher as the matching degree of the order is higher. For this reason, when the bag-of-words vector is used for comparison of log sequences, a comparison result reflecting the characteristics of the log sequences cannot be obtained (see Non-Patent Document 1).

  The log includes a series of series output by various functions. Therefore, it is preferable not only to simply compare log sequences, but also to compare log sequences by a method that allows the similarity to be calculated even when various logs output by different functions are mixed. Thus, as another method for comparing sequences, it is conceivable to use DP (Dynamic Programming) matching (dynamic programming). When DP matching is used, even if other logs are mixed, it is possible to obtain the optimal number of lines while maintaining the arrangement order. However, in a log sequence, the similarity is higher as multiple lines are matched continuously. However, DP matching allows too much discontinuous matching, and the degree of similarity is increased when matching continuously. It cannot be evaluated as high (see Non-Patent Document 2).

  An embodiment of the disclosure has been made in view of the above, and an object of the present invention is to detect an abnormality log by determining the similarity of a log sequence reflecting the characteristics of the log sequence.

  The disclosed abnormal log detection system and abnormal log detection method extract a log sequence of a predetermined number of lines of two or more lines by shifting the head line by line from the log of the information system. The abnormal log detection system and the abnormal log detection method create a log matching line number series by shifting the extracted one log series one line at a time and counting the number of lines that match the other log series. The product of the area and kurtosis of the number series is calculated as the similarity. The abnormality log detection system and the abnormality log detection method detect an abnormality in one log series based on the calculated similarity.

  The disclosed abnormal log detection system and abnormal log detection method have an effect that an abnormal log can be detected by determining the similarity of log sequences reflecting the characteristics of log sequences.

FIG. 1 is a diagram illustrating an example of a configuration of an abnormality log detection system according to the first embodiment. FIG. 2 is a diagram for explaining an overview of processing in the abnormality log detection system according to the first embodiment. FIG. 3 is a flowchart illustrating an example of a rough flow of the abnormality log detection process according to the first embodiment. FIG. 4 is a diagram for explaining an example of a log sequence extraction method according to the first embodiment. FIG. 5 is a diagram for explaining an example of a technique for calculating the similarity between log sequences in the abnormality log detection system according to the first embodiment. FIG. 6 is a diagram for explaining a case where the two log sequences shown in FIG. 5 are matched. FIG. 7 is a diagram for describing a specific example of comparison of log sequences and calculation of similarity in the first embodiment. FIG. 8 is a diagram for explaining the abnormality detection process according to the first embodiment. FIG. 9 is a diagram illustrating an example of a computer in which an abnormality log detection apparatus is realized by executing a program.

  In the following, embodiments of the disclosed system and method will be described in detail based on the drawings. In addition, this invention is not limited by this embodiment. Moreover, each embodiment can be combined suitably.

(First embodiment)
FIG. 1 is a diagram illustrating an example of a configuration of an abnormality log detection system 1 according to the first embodiment. The abnormality log detection system 1 according to the first embodiment includes an abnormality log detection device 10 and an information processing system 20. The abnormality log detection apparatus 10 and the information processing system 20 are communicably connected via a network 30.

  The abnormality log detection apparatus 10 acquires a log from the information processing system 20 and analyzes the log, thereby obtaining a log evaluated as a normal state and a log evaluated as an abnormal log deviating from the normal state. Distinguish and detect abnormal logs.

  The information processing system 20 performs information processing. The configuration and function of the information processing system 20 are not particularly limited as long as it is a system that executes predetermined information processing and accumulates logs according to the executed information processing. The information processing system 20 transmits logs generated and accumulated in accordance with information processing to the abnormality log detection device 10. The log transmission timing is not particularly limited, but from the viewpoint of sequentially monitoring the state of the information processing system 20 and realizing stable operation, the information processing system 20 generates the log every time it generates a log. Is preferably configured to transmit to. Although FIG. 1 illustrates the abnormal log detection device 10 and the information processing system 20 as separate bodies, the abnormal log detection device 10 may be configured to be incorporated in the information processing system 20 that is a monitoring target. .

  The network 30 is an arbitrary communication network. The type of network 30 is not particularly limited. The network 30 is an arbitrary communication network such as the Internet, a WAN (Wide Area Network), and a LAN (Local Area Network). The network 30 may be wired or wireless, or a combination of both.

  FIG. 2 is a diagram for explaining an overview of processing in the abnormality log detection system 1 according to the first embodiment. As illustrated in FIG. 2, the abnormality log detection device 10 acquires a log output from the information processing system 20. The log consists of multiple lines. The abnormality log detection apparatus 10 that has acquired a log composed of a plurality of rows accumulates the acquired log and executes a learning process. The abnormality log detection device 10 identifies a normal state of the log and an abnormal state deviating from the normal state through a learning process. Then, the abnormality log detection device 10 detects an abnormality log that deviates from the normal state by comparing the log output from the information processing system 20 with the learned log. The abnormality log detection device 10 outputs (notifies) information of the detected abnormality log to the outside. Thereby, the maintainer of the information processing system 20 can take an action such as detecting an abnormality in the information processing system 20 and requesting the developer to analyze it.

  Thus, according to the abnormality log detection system 1 of 1st Embodiment, the log which deviates from a normal state can be detected, and a maintenance person can be notified at an early stage. The maintenance person can take measures such as causing the developer to analyze the abnormality log in detail at an early stage, and can prevent a trouble in the information processing system 20 and realize a stable operation.

  Next, referring back to FIG. 1, an example of the configuration of the abnormality log detection device 10 and an example of the flow of abnormality log detection processing in the abnormality log detection device 10 will be described.

(Example of the configuration of the abnormality log detection device 10)
The abnormality log detection apparatus 10 includes a control unit 100, a storage unit 200, and a communication unit 300.

  The control unit 100 controls abnormality log detection processing in the abnormality log detection device 10. As the control unit 100, an electronic circuit such as a CPU (Central Processing Unit) or MPU (Micro Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array) can be used. . In addition, the control unit 100 includes a storage unit that stores a program that defines a processing procedure and the like in the abnormality log detection device 10 and control data. The control unit 100 functions as various processing units by operating various programs.

  The control unit 100 includes an acquisition unit 101, an extraction unit 102, a calculation unit 103, and a detection unit 104.

  The acquisition unit 101 acquires a log from the information processing system 20. The acquisition unit 101 stores the acquired log in the storage unit 200. In addition, the acquisition unit 101 transmits the acquired log to the extraction unit 102.

  The extraction unit 102 extracts a log sequence having a predetermined number of rows from the log acquired by the acquisition unit 101. Specifically, the extraction unit 102 extracts the log acquired by the acquisition unit 101 as a log sequence by shifting a line at a time by a predetermined number of lines. The extraction unit 102 sets the extracted log sequence of a predetermined number of rows n (n is a natural number of 2 or more) as an n-dimensional vector (n-dimensional log sequence).

  The calculation unit 103 calculates the similarity by comparing the log series extracted by the extraction unit 102 with other extracted log series. Details of the calculation of the similarity will be described later.

  The detection unit 104 detects an abnormality in the log series based on the similarity calculated by the calculation unit 103. For example, the detection unit 104 includes an abnormal log when the upper predetermined number of similarities among the similarities between a log sequence and a plurality of other log sequences is equal to or lower than a threshold (that is, the similarity is low). Is determined. When the upper predetermined number of similarities is greater than the threshold, the detection unit 104 determines that the log series does not include an abnormality log. The detection unit 104 outputs the determination result to the outside of the abnormality log detection device 10.

  The storage unit 200 is a storage device that stores various data. The storage unit 200 may be a semiconductor memory that can rewrite data, such as a RAM (Random Access Memory) and a flash memory. The device used as the storage unit 200 is not particularly limited.

  The storage unit 200 includes a log storage unit 201, a log series storage unit 202, a similarity storage unit 203, and a detection result storage unit 204.

  The log storage unit 201 stores a log acquired by the acquisition unit 101 from the information processing system 20.

  The log series storage unit 202 stores the log series extracted by the extraction unit 102.

  The similarity storage unit 203 stores the similarity between log sequences calculated by the calculation unit 103.

  The detection result storage unit 203 stores the log series determined by the detection unit 104 as including an abnormality log.

  Each unit included in the storage unit 200 can be appropriately integrated and distributed. Further, the configuration of the stored information can be changed as appropriate.

  The communication unit 300 performs communication between the abnormality log detection device 10 and the outside. The communication unit 300 transmits information on the abnormality log detected by the detection unit 104 to the outside. The communication unit 300 also receives a log output from the information processing system 20. The specific configuration of the communication unit 300 is not particularly limited as long as it enables communication with the outside. The communication unit 300 also includes functions of an input unit and an output unit that execute input and output of information.

(Example of abnormal log detection process flow)
FIG. 3 is a flowchart illustrating an example of a rough flow of the abnormality log detection process according to the first embodiment.

  The abnormality log detection device 10 starts monitoring the information processing system 20 in response to a predetermined trigger such as power-on or instruction input (step S41). When the abnormality log detection device 10 starts monitoring, the acquisition unit 101 acquires the log output from the information processing system 20 via the communication unit 300 and stores it in the log storage unit 201 (step S42). When the logs are acquired, the extraction unit 102 shifts the acquired logs line by line and extracts n lines of logs as an n-dimensional log series (step S43). The calculating unit 103 calculates the similarity between the extracted log series and other extracted log series (step S44). The detection unit 104 determines that the log series includes an abnormality log when the upper predetermined number of similarities is equal to or less than a threshold value. When the upper predetermined number of similarities is greater than the threshold, the detection unit 104 determines that the log series does not include an abnormality log. The detection unit 104 outputs the detection result to the outside (step S45). The above is an example of a rough flow of the abnormality log detection process.

(Example of log sequence extraction method)
FIG. 4 is a diagram for explaining an example of a log sequence extraction method according to the first embodiment. As shown in FIG. 4, it is assumed that “A, B, C, D, E, F, G,...” Is output from the information processing system 20 and acquired by the abnormality log detection device 10 as a log. In FIG. 4, each capital letter of the alphabet represents one line. At this time, it is assumed that the abnormality log detection apparatus 10 has previously set five lines as one log series. The extraction unit 102 extracts “A, B, C, D, E” for the first five lines as one log series. In addition, the extraction unit 102 extracts the next log sequence with the position shifted by one line from the top of the log sequence extracted first. That is, the extraction unit 102 extracts “B, C, D, E, F” for five lines starting from the second line as the next log series. Further, the extraction unit 102 further shifts one row and extracts “C, D, E, F, G” for five rows starting from the third row as the next log series. In this manner, the extraction unit 102 extracts a predetermined number of lines from the acquired log while shifting the head line by line, and extracts the log series.

(Example of log series similarity calculation method)
FIG. 5 is a diagram for explaining an example of a technique for calculating the similarity between log sequences in the abnormality log detection system according to the first embodiment. FIG. 6 is a diagram for explaining a case where the two log sequences shown in FIG. 5 are matched. As an example, in FIG. 5, the similarity between the 5-line log series a “Z, A, B, Y, C” and the 5-line log series b “A, B, C, D, E” is calculated. Will be explained. The calculation unit 103 matches the two log series by shifting one line at a time. For example, when the log sequence a “Z, A, B, Y, C” and the log sequence b “A, B, C, D, E” are matched with each other at the head, there is no matching portion between the two. ((1) in FIG. 6). When the log series b is shifted to the right by one line and matched with the log series a, “A, B” coincides between them ((2) in FIG. 6). When the log series b is further shifted to the right by one line, a total of two lines, and matched with the log series a, “C” matches ((3) in FIG. 6). In this way, the calculation unit 103 shifts one of the log series for which the similarity is to be calculated one line at a time, matches the two log series, and counts the number of matching lines.

  The calculation unit 103 creates a series d of the number of matched rows based on the matching result. For example, in the example of FIG. 5, the calculation unit 103 creates a log matching row number series d = (0, 0, 1, 2, 0, 0, 0, 0, 0). The calculation unit 103 sets an order in which two log series are matched in advance, and creates a log matching line number series as a vector by arranging the number of matching lines according to the order. For example, in the example of FIG. 6, the number of offsets is set from “1” to “9”, and when the number of offsets is “1”, the log series b is shifted four lines to the right from the log series a. When the offset number is “2”, the log sequence b is shifted to the right by 3 lines from the log sequence a. When the offset number is “3”, the log series b is shifted to the right by 2 lines from the log series a. Then, the number of matching rows for each offset number is counted and vectorized. When the number of matching lines is arranged in the order of offsets “1” to “9” as shown in FIG. 6, a log matching line number series d shown in FIG. 5 is obtained.

と、ｎ次元のログ系列Ｂ

と、があるとする。ログ系列Ａとログ系列Ｂとの類似度を算出する場合、ログ一致行数系列

を、

と定義する。この場合、ログ一致行数系列の面積ｓおよび尖度ｋはそれぞれ、以下の式（１）（２）で定義される。なお、式（２）中、ｖは分散を示す。 Then, the calculation unit 103 calculates the product of the area s (normalized by the length of the sequence) of the log matching row number series and the kurtosis k as the similarity m. For example, n-dimensional (n rows) log sequence A

And n-dimensional log series B

Suppose that there is. When calculating the similarity between log series A and log series B, log matching line number series

The

It is defined as In this case, the area s and the kurtosis k of the log matching row number series are defined by the following equations (1) and (2), respectively. In the formula (2), v represents dispersion.

  Since the similarity m between the log series A and the log series B is the product of the area s and the kurtosis k, it is expressed by the following equation (3).

  Further, the distance between the log sequence A and the log sequence B is expressed by the reciprocal of the similarity, that is, the equation (4).

  Based on the above, referring to FIG. 7, as an example, the log sequence H1 = (Z, A, B, Y, C), H2 = (U, V, A, W, Y), L = (A, B, C) , D, E), consider the case of calculating the similarity between H1 and L and the similarity between H2 and L. FIG. 7 is a diagram for describing a specific example of comparison of log sequences and calculation of similarity in the first embodiment.

  FIG. 7A shows a case where the log sequence H1 and the log sequence L are compared. When the log series H1 and the log series L are shifted and matched one line at a time, when the log series L is shifted to the right by one line from H1, the lines “A, B” match. Further, when the log series L is shifted by two lines to the right of H1, the line “C” matches. Otherwise, there is no matching line. Accordingly, the log matching line number series of the log series H1 and the log series L can be expressed by Expression (5).

  Here, when the area s is calculated based on the formula (1) for the log matching row number series of the formula (5), s = 0.33. Further, when the kurtosis k is calculated based on the formula (2), k = 2. Therefore, the similarity between the log sequence H1 and the log sequence L is m (H1, L) = 0.67.

  On the other hand, FIG. 7B shows a case where the log series H2 and the log series L are compared. When the log series H2 and the log series L are shifted and matched one line at a time, when the log series L is shifted two lines to the right of H2, the line “A” matches. Otherwise, there is no matching line. Accordingly, the log matching row number series of the log series H2 and the log series L can be expressed by Expression (6).

  Here, when the area s is calculated based on the formula (1) for the log matching row number series of the formula (6), s = 0.11. Further, when the kurtosis k is calculated based on the formula (2), k = 0.70. Therefore, the similarity between the log sequence H2 and the log sequence L is m (H2, L) = 0.078.

  When the log series H1 and the log series L and the log series H2 and the log series L are compared, the log series H2 and the log series L have a larger area and kurtosis than the log series H1 and the log series L. It is small and the similarity calculated as a result is also small. That is, it can be evaluated that the log sequence H1 is more similar to the log sequence L than the log sequence H2.

  As described above, the abnormality log detection apparatus 10 according to the first embodiment extracts the log series by shifting the first line from the log one line at a time, and then compares the log line with the other log series as described above. A number series is derived and the similarity between log series is calculated. For this reason, even if logs generated by different functions are mixed in one log series, the abnormality log detection apparatus 10 can consider the order of logs and the continuity of the logs. Can be calculated.

(Example of abnormality detection processing)
FIG. 8 is a diagram for explaining the abnormality detection process according to the first embodiment. For example, an outlier detection method such as LOF (Local Outlier Factor) can be used as a method for the detection unit 104 to detect a log sequence including an abnormal log. First, a method for detecting an outlier will be described with reference to FIG.

  When the log series is extracted and the similarity is calculated as described above, the distance between the log series can be expressed by the reciprocal of the similarity (the above formula (4)). When the distance between the log series obtained in this way is graphed, for example, the graph shown in FIG. 8 is obtained. In the graph of FIG. 8, cluster 1 and cluster 2 are shown. Log series p and q included in cluster 1 are log series extracted in the past. The log series r included in the cluster 2 is also a log series extracted in the past. The newly extracted log sequence evaluates the distance from the log sequence extracted in the past, and if it is close to the cluster (group) formed by the log sequence extracted in the past, the log sequence extracted in the past It can be evaluated that the log series is similar. Conversely, if the newly extracted log sequence is far from any cluster formed by the log sequence extracted so far, it is evaluated that the log sequence includes an abnormal log that deviates from the normal state. Can do.

  In the example of FIG. 8, for example, it is assumed that a new log series a is extracted. Then, when the distances between the log series a, the log series p, and the log series q are calculated, it is assumed that the log series a is arranged at the position shown in the graph. In this case, the distance between the log series a and the log series p and q is not much different from the distance between the other log series and the log series p and q constituting the same cluster 1. That is, the log sequence a can be evaluated as a log sequence in a normal state that constitutes the cluster 1.

  On the other hand, assume that a new log series b is extracted in the example of FIG. Then, when the distance between the log series b, the log series q, and the log series r is calculated, it is assumed that the log series b is arranged at the position shown in the graph. In this case, the distance between the log series b and the log series q is far compared with the distance between the other log series belonging to the cluster 1 and the log series q. Further, the distance between the log series b and the log series r is far compared with the distance between the other log series belonging to the cluster 2 and the log series r. Therefore, it can be evaluated that the log series b is a log series that does not belong to either cluster 1 or cluster 2 and deviates from the normal state.

  In this way, it is possible to determine whether or not the log sequence deviates from the normal state using the distance calculated for each log sequence.

  The specific procedure of the abnormality detection process is not particularly limited as long as it is detected based on the similarity or distance calculated by the calculation unit 103. Further, the threshold value used for abnormality detection may be set based on the similarity or distance calculated from the past log series. Machine learning or the like may be used for setting the threshold. The threshold value may be sequentially updated based on the similarity or distance newly calculated from the log series.

(Effects of the first embodiment)
The abnormality log detection system according to the first embodiment includes an extraction unit, a calculation unit, and a detection unit. The extraction unit extracts a log sequence having a predetermined number of lines of two or more lines by shifting the head line by line from the log of the information system. The calculation unit creates a log matching line number series by counting the number of lines that match another log series while shifting the extracted one log series line by line, and the area and kurtosis of the created log matching line number series Is calculated as the similarity. The detection unit detects an abnormality in one log series based on the calculated similarity. Therefore, the abnormality log detection system can detect the abnormality log by determining the similarity of the log series reflecting the characteristics of the log series. Further, the abnormality log detection system can calculate the similarity between log sequences even when the log sequence includes logs resulting from a plurality of functions. In addition, the abnormality log detection system can calculate a similarity that reflects the order and continuity of logs.

を抽出し、算出部は、２つのｎ行数のログ系列のログ一致行数系列

について、

により定義される面積ｓと、

（ただし式中、ｖは分散）により定義される尖度ｋと、の積

を、類似度として算出する。このため、異常ログ検出システムは、ログ系列に含まれるログの並び順や連続性も加味しつつ、ログ系列間の類似度を算出することができる。また、ログ系列に複数機能に起因するログが含まれていても、ログ系列間の類似度を算出することができる。 In the abnormality log detection system according to the first embodiment, the extraction unit includes at least two log sequences of n rows.

The calculation unit extracts the log matching line number series of the two n line log series.

about,

An area s defined by

Product of kurtosis k defined by (where v is the variance)

Is calculated as the similarity. For this reason, the abnormality log detection system can calculate the similarity between the log sequences while taking into consideration the arrangement order and continuity of the logs included in the log sequence. Further, even when logs resulting from a plurality of functions are included in the log series, the similarity between the log series can be calculated.

  In the abnormality log detection system according to the first embodiment, the calculation unit further calculates a distance between one log series and another log series based on the similarity, and the detection unit determines the similarity. Based on the calculated distance, an abnormality in one log series is detected. For this reason, the abnormal log detection system can easily detect a log sequence deviating from the normal state based on the similarity between log sequences represented by the distance.

  In the abnormality log detection system according to the first embodiment, the calculation unit calculates the reciprocal of the similarity as a distance, and the detection unit calculates the distance between one log series and another log series as another log. If the distance between the series is longer than a predetermined value, an abnormality in one log series is detected. For this reason, the abnormal log detection system can easily detect a log sequence deviating from the normal state.

  Further, the abnormality log detection system configured as described above can automatically monitor the information system, learn the normal state of the log, and detect a log that deviates from the normal state. For this reason, the abnormal log detection system can detect logs that behave abnormally different from normal at an early stage, respond to problems in the information processing system at an early stage, and realize stable operation of the information processing system. To do.

(System configuration etc.)
Further, each component of each illustrated apparatus is functionally conceptual, and does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each device is not limited to that shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured. Further, all or any part of each processing function performed in each device is realized by a CPU (Central Processing Unit) and a program analyzed and executed by the CPU, or hardware by wired logic. Can be realized as

  In addition, among the processes described in the present embodiment, all or part of the processes described as being automatically performed can be manually performed, or the processes described as being manually performed can be performed. All or a part can be automatically performed by a known method. In addition, the processing procedure, control procedure, specific name, and information including various data and parameters shown in the above-described document and drawings can be arbitrarily changed unless otherwise specified.

(program)
As an embodiment, the abnormality log detection apparatus 10 can be implemented by installing an abnormality log detection program for executing the above monitoring as package software or online software on a desired computer. For example, the information processing apparatus can function as the abnormality log detection apparatus 10 by causing the information processing apparatus to execute the above-described abnormality log detection program. The information processing apparatus referred to here includes a desktop or notebook personal computer. In addition, the information processing apparatus includes mobile communication terminals such as smartphones, mobile phones and PHS (Personal Handyphone System), and slate terminals such as PDA (Personal Digital Assistants).

  In addition, the abnormality log detection device 10 can be implemented as a server device that uses a terminal device used by a user as a client and provides the client with the above-described service related to abnormality log detection. For example, the abnormality log detection device 10 is implemented as a server device that provides an abnormality log detection service that receives a log as an input and outputs a log sequence including the detected abnormality log. In this case, the abnormality log detection device 10 may be implemented as a Web server, or may be implemented as a cloud that provides the above-described service relating to abnormality log detection by outsourcing.

  FIG. 9 is a diagram illustrating an example of a computer in which an abnormality log detection apparatus is realized by executing a program. The computer 1000 includes a memory 1010 and a CPU 1020, for example. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These units are connected by a bus 1080.

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012. The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. The disk drive interface 1040 is connected to the disk drive 1100. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to the display 1130, for example.

  The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the abnormality log detection apparatus 10 is implemented as a program module 1093 in which a code executable by the computer 1000 is described. The program module 1093 is stored in the hard disk drive 1090, for example. For example, a program module 1093 for executing processing similar to the functional configuration in the abnormality log detection device 10 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

  The setting data used in the processing of the above-described embodiment is stored as program data 1094 in, for example, the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the memory 1010 and the hard disk drive 1090 to the RAM 1012 and executes them as necessary.

  The program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in, for example, a removable storage medium and read out by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). The program module 1093 and the program data 1094 may be read by the CPU 1020 from another computer via the network interface 1070.

  The above embodiments and modifications thereof are included in the invention disclosed in the claims and equivalents thereof as well as included in the technology disclosed in the present application.

DESCRIPTION OF SYMBOLS 1 Abnormality log detection system 10 Abnormality log detection apparatus 20 Information processing system 30 Network 100 Control part 101 Acquisition part 102 Extraction part 103 Calculation part 104 Detection part 200 Storage part 201 Log storage part 202 Log sequence storage part 203 Similarity degree storage part 204 Detection Result storage unit 300 Communication unit

Claims (5)

An extraction unit that extracts a log sequence of a predetermined number of lines of two or more lines by shifting the head line by line from the log of the information system;
While shifting the extracted log series one line at a time, count the number of lines that match the other log series to create a log matching line number series, and multiply the area and kurtosis of the created log matching line number series , As a similarity,
Based on the calculated similarity, a detection unit that detects an abnormality in the one log series;
An abnormal log detection system comprising: The extraction unit includes at least two log sequences of n rows.

Extract
The calculation unit includes a log matching row number sequence of the two n row log sequences.

about,

An area s defined by

Product of kurtosis k defined by (where v is the variance)

The abnormality log detection system according to claim 1, wherein the similarity is calculated as the similarity. The calculation unit further calculates a distance between the one log series and the other log series based on the similarity,
The abnormality log detection system according to claim 1, wherein the detection unit detects an abnormality of the one log series based on the distance calculated based on the similarity. The calculation unit calculates the reciprocal of the similarity as the distance,
The detection unit detects an abnormality in the first log series when a distance between the first log series and the other log series is longer than a distance between the other log series by a predetermined value or more. The abnormality log detection system according to claim 3, wherein An extraction step of extracting a log sequence of a predetermined number of lines of two or more lines by shifting the head line by line from the log of the information system;
While shifting the extracted log series one line at a time, count the number of lines that match the other log series to create a log matching line number series, and multiply the area and kurtosis of the created log matching line number series , As a similarity,
A detection step of detecting an abnormality in the log sequence of 1 based on the calculated similarity;
An abnormality log detection method characterized in that a computer executes the process.

Images