Semi-supervised Power Microservices Log Anomaly Detection Based on BiLSTM and BERT with Attention

The software industry has seen a rise in the size and intricacy of software in recent years, leading to a growing concern about how to accurately identify, analyze, and pinpoint abnormal behavior that may occur during system operation. Power system microservices are becoming increasingly popular as a way to manage and monitor the complex and distributed attributes of modern power grids. System logs of power system microservices are used to document the status of power system and important occurrences at crucial points in order to help with troubleshooting performance problems and malfunctions, which plays a crucial role in maintaining the stability and reliability of power grids. Traditional anomaly detection methods based on white-box testing require access to the system source code and may not be applicable. Current abnormality detection methods based on system logs primarily focus on extracting log template characteristics, but they pay little attention to the semantic meaning of logs. In order to detect anomalies from system logs more effectively, this work proposes a log execution path anomaly detection method based on Bi-directional Long Short-Term Memory (BiLSTM) with attention. The semantics of log key is also taken into consideration using BERT model for semantic information extraction. Additionally, attention mechanism is used to adjust feature weights at different time steps and select important words. In training phase, a sliding window generates log key sequences from parsed logs to train the model. In detection phase, the model takes as input the parsed log sequence and outputs the probability distribution of the next log key. Experimental results indicate that the proposed method has outperformed conventional approaches on several metrics, including recall rate and F1 score.