정확한 로그 객체 인식 기술
An Accurate Log Object Recognition Technique
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
본 논문에서는 로그 분석을 어렵게 하는 요인을 제안하고 이후 분석에 도움을 주는 로그 내 다양한 객체 인식 기법을 설계한다. 오늘날의 IT 시스템에서 로그는 다수의 고급 AI 분석 기술의핵심적인 원천 데이터이다. 로그에는 유용한 정보가 많이 포함되어 있지만 로그는 본질적으로 반구조화되어 있기 때문에 로그 내 유용 정보에 기술을 직접적으로 적용시키기 어렵다. 로그 분석을 방해하는 요소는 file path, identifier, json 등 다양한 객체이다. 이러한 객체에 대한 BERT기반의패턴 인식 알고리즘을 설계하고 객체 인식을 수행한다. 본 실험에서 정의한 패턴 인식 알고리즘은 객체의 정의, GROK 패턴, 그리고 정규 표현식에 기반한다. 기존에 알려진 패턴과 정규 표현식을 기반으로 한 간단한 패턴 매칭이 효과적이지 않다는 것을 확인할 수 있었다. 그 결과 기존 패턴과 정규 표현식만을 사용하는 것보다 훨씬 나은 정확도를 보여준다. 또한, BERT 모델의 경우인식 객체 이외의 객체를 분류하는 정확도가 99%에 달하는 것을 확인할 수 있다.
Abstract
In this paper, we propose factors that make log analysis difficult and design technique for detecting various objects embedded in the logs which helps in the subsequent analysis. In today’s IT systems, logs have become a critical source data for many advanced AI analysis techniques. Although logs contain wealth of useful information, it is difficult to directly apply techniques since logs are semi-structured by nature. The factors that interfere with log analysis are various objects such as file path, identifiers, JSON documents, etc. We have designed a BERT-based object pattern recognition algorithm for these objects and performed object identification. Object pattern recognition algorithms are based on object definition, GROK pattern, and regular expression. We find that simple pattern matchings based on known patterns and regular expressions are ineffective. The results show significantly better accuracy than using only the patterns and regular expressions. In addition, in the case of the BERT model, the accuracy of classifying objects reached as high as 99%.
참고문헌 (32)
- Debnath, Biplob, "LogLens: A real-time log analysis system", 2018 IEEE 38th international conference on distributed computing systems (ICDCS), pp.1052~1062 (2018)
- Alspaugh, Sara, "Analyzing log analysis: An empirical study of user log mining", 28th Large Installation System Administration Conference (LISA14), pp.62~77 (2014)
- Kulkarni, Juily, "Analysis of system logs for pattern detection and anomaly prediction", Proceeding of International Conference on Computational Science and Applications, pp.427~436 (2020), Springer
- Chaudhari, Swati, "Real time logs and traffic monitoring, analysis and visualization setup for IT security enhancement", 5th International Conference on Next Generation Computing Technologies (NGCT-2019) 2020 (2019)
- J. Zhu, "Tools and Benchmarks for Automated Log Parsing", 2019 IEEE, 2019, 121~130
- Tak, Byungchul, "Lognroll : discovering accurate log templates by iterative filtering", Proceedings of the 22nd International Middleware Conference, pp.273~285 (2021)
- S. J. Son, "Performance of ELK stack and commercial system in security log analysis", 2017 IEEE 13th Malaysia International Conference on Communications (MICC), pp.187~190 (2018)
- M. Bajer, "Building an IoT Data Hub with Elasticsearch, Logstash and Kibana", 2017 5th International Conference on Future Internet of Things and Cloud Workshops (FiCloudW), pp.63~68 (2017)
- A. F. Rochim, "Design Log Management System of Computer Network Devices Infrastructures Based on ELK Stack", 2019 International Conference on Electrical Engineering and Computer Science (ICECOS), pp.338~342 (2020)
- Jin, Zhongjun, "Auto-transform : learning-to-transform by patterns", Proceedings of the VLDB Endowment, 13(12), pp.2368~2381 (2020)
- A. Leadbetter, "Where big data meets linked data: Applying standard data models to environmental data streams", 2016 IEEE International Conference on Big Data (Big Data), pp.2929~2937 (2017)
- Guo, Haixuan, "Logbert: Log anomaly detection via bert", 2021 international joint conference on neural networks (IJCNN) (2021), IEEE
- Song Chen, "BERT-Log: Anomaly Detection for System Logs Based on Pre-trained Language Model", Applied Artificial Intelligence, 36(1), pp.2145642~ (2022), Informa UK Limited[DOI]
- T. Prakash, "Geo-identification of web users through logs using ELK stack", 2016 6th International Conference - Cloud System and Big Data Engineering (Confluence), pp.606~610 (2016)
- P. He, "Drain: An Online Log Parsing Approach with Fixed Depth Tree", 2017 IEEE International Conference on Web Services (ICWS), pp.33~40 (2017)
- R. Vaarandi, "A data clustering algorithm for mining patterns from event logs", Proceedings of the 3rd IEEE Workshop on IP Operations & Management(IPOM 2003)(IEEE Cat. No. 03EX764), pp.119~126 (2003), IEEE
- Makanju, "Clustering event logs using iterative partitioning", Proceedings of the 15th ACM SIGKDD international conference on Knowledge discovery and data mining, pp.1255~1264 (2009)
- R. Vaarandi, "LogCluster-A data clustering and pattern mining algorithm for event logs", 2015 11th International Conference on Network and Service Management (CNSM), pp.1~7 (2015)
- Q. Fu, "Execution Anomaly Detection in Distributed Systems through Unstructured Log Analysis", 2009 Ninth IEEE International Conference on Data Mining, pp.149~158 (2009)
- S. Messaoudi, "A Search-Based Approach for Accurate Identification of Log Message Formats", 2018 IEEE, 2020, 167~16710
- M. Du, "Spell: Streaming Parsing of System Event Logs", 2016 IEEE 16th International Conference on Data Mining (ICDM), pp.859~864 (2017)
- H. Hamooni, "LogMine: fast pattern recognition for log analytics", CIKM, pp.1573~1582 (2016)
- Tang, "LogSig:Generating system events from raw textual logs", Proceedings of the 20th ACM international conference on Information and knowledge management, pp.785~794 (2011)
- Mizutani, Masayoshi, "Incremental mining of system log format", 2013 IEEE International Conference on Services Computing, pp.7~ (2013)
- Zhen Ming Jiang, "An automated approach for abstracting execution logs to execution events", Journal of Software Maintenance and Evolution: Research and Practice, 20(4), pp.249~267 (2008), Wiley[DOI]
- He, Pinjia, "An evaluation study on log parsing and its use in log mining", 2016 46th annual IEEE, 2016, ~
- Du, Min, "Deeplog: Anomaly detection and diagnosis from system logs through deep learning", Proceedings of the 2017ACM SIGSAC conference on computer and communications security (2017)
- Xu, Wei, "Detecting large-scale system problems by mining console logs", Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles, pp.117~132 (2009)