ONLINE DETECTION OF ANOMALIES WITHIN A LOG USING MACHINE LEARNING

摘要

Improvements in how anomalies are detected within a tracked execution path of an application are disclosed. Log entries in a log are parsed into respective structured data sequences that include a log key and a parameter set for each entry. The combination of these structured data sequences represents an execution path for the application. A vector is then generated, where the vector includes the parameter sets and a set of time values indicating how much time elapsed between each adjacent log entry in the log. A machine learning sequential (MLS) model is then trained using the vectors and the log keys. When the MLS model is applied to a new log entry, the MLS model generates a probability indicating an extent to which the new log entry is normal or abnormal. The MLS model may be applied in a streaming manner to detect anomalies in a quick and efficient manner.