北京邮电大学学报

  • EI核心期刊

北京邮电大学学报 ›› 2020, Vol. 43 ›› Issue (1): 68-73.doi: 10.13190/j.jbupt.2019-033

• 论文 • 上一篇    下一篇

基于归一化特征判别的日志模板挖掘算法

双锴1,2, 李怡雯1, 吕志恒1, 韩静3, 刘建伟3   

  1. 1. 北京邮电大学 网络与交换技术国家重点实验室, 北京 100876;
    2. 通信网信息传输与分发技术重点实验室, 石家庄 050081;
    3. 中兴通讯股份有限公司, 深圳 518057
  • 收稿日期:2019-03-22 出版日期:2020-02-28 发布日期:2020-03-27
  • 作者简介:双锴(1977-),男,副教授,硕士生导师,E-mail:shuangk@bupt.edu.cn.
  • 基金资助:
    国家重点研发计划项目(2016QY01W0200);上海市青年科技英才扬帆计划项目(18YF1423300);通信网信息传输与分发技术重点实验室开放基金课题(SXX18641X024)

Log Template Extraction Algorithm Based on Normalized Feature Discrimination

SHUANG Kai1,2, LI Yi-wen1, Lü Zhi-heng1, HAN Jing3, LIU Jian-wei3   

  1. 1. State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing 100876, China;
    2. Science and Technology of Information Transmission and Dissemination in Communication Networks Laboratory, Shijiazhuang 050081, China;
    3. ZTE Corporation, Shenzhen 518057, China
  • Received:2019-03-22 Online:2020-02-28 Published:2020-03-27
  • Supported by:
     

摘要: 针对传统日志模板挖掘时需要日志聚类数目作为先验信息的问题,提出了一种基于归一化特征判别的日志模板挖掘算法.首先,对日志数据进行压缩,以提高后续处理效率;其次,进行日志聚类过程,使用归一化的日志统计特征判断聚类是否满足要求,若满足,则聚类成功;若不满足,则采用二分搜索的方式调整日志聚类的数目,重新进行聚类;最后,从聚类结果中提取日志模板,设计了一种衡量模板挖掘效果的评价指标.在真实数据集上的实验结果表明,算法的模板挖掘匹配度优于基准方法,并且具有良好的泛化性能.

关键词: 模板挖掘, 日志分析, 文本聚类, 归一化特征

Abstract: A log template extraction algorithm based on normalized feature discrimination is proposed, aiming at the problem that the number of clusters needs to be provided as a priori information in traditional log template extraction. First, log data is initially compressed to reduce data redundancy. Then, a log clustering process is implemented, and the normalized feature is used to discriminate whether the clustering result meets requirement:if so, the clustering process is successfully completed; if not, the number of log clusters is adjusted by using binary search and redo clustering. Finally, the log template is extracted via clustering results. In addition, an evaluation metric that measures the effectiveness of template extraction is designed. Experiments on real data indicated that the algorithm can achieve more stable and accurate template extraction performance than the benchmark method, and it had good generalization performance.

Key words: template extraction, log analysis, text clustering, normalized feature

中图分类号: