Log representation learning for automated system maintenance

Patent metadata

Field	Value
Publication number	US-2025094271-A1
Application number	US-202418829545-A
Country	US
Kind code	A1
Filing date	Sep 10, 2024
Priority date	Sep 20, 2023
Publication date	Mar 20, 2025
Grant date	—

Abstract

Systems and methods for log representation learning for automated system maintenance. An optimized parser can transform collected system logs into log templates. A tokenizer can tokenize the log templates partitioned into time windows to obtain log template tokens. The log template tokens can train a language model (LM) with deep learning to obtain a trained LM. The trained LM can detect anomalies from system logs to obtain detected anomalies. A corrective action can be performed on a monitored entity based on the detected anomalies.

First claim

What is claimed is:

1 . A computer-implemented method for log representation learning for automated system maintenance, comprising:
transforming collected system logs into log templates using an optimized parser; tokenizing the log templates partitioned into time windows to obtain log template tokens; training a language model (LM) with deep learning using the log template tokens to obtain a trained LM; detecting anomalies from system logs using the trained LM to obtain detected anomalies; and performing a corrective action to a monitored entity based on the detected anomalies.

2 . The computer-implemented method of claim 1 , wherein performing a corrective action further comprises updating a medical diagnosis of a patient based on the detected anomalies from system logs, that includes healthcare data of the patient, collected from a healthcare data system.

3 . The computer-implemented method of claim 1 , wherein transforming collected system logs further comprises optimizing a parser to eliminate noise and extraneous information from system logs.

4 . The computer-implemented method of claim 1 , wherein tokenizing the log templates further comprises partitioning system logs into multiple time windows with a fixed window size to capture unique log sequences within a specific time range.

5 . The computer-implemented method of claim 1 , wherein training a large language model further comprises fine-tuning the trained LM using incoming system logs to optimize performance and adaptability.

6 . The computer-implemented method of claim 5 , wherein training a large language model further comprises computing a global loss function that maps log sequences to representation vectors that have an average minimum distances to a center in a latent space in an embedding layer using a recurrent neural network.

7 . The computer-implemented method of claim 6 , wherein training a large language model further comprises computing a local loss function that obtains a sequence of hidden representations that encode sequential dependences in local regions in the latent space.

8 . The computer-implemented method of claim 7 , wherein training a large language model further comprises fusing the global loss function and the local loss function to obtain a fused loss function to train the LM using the fused loss function.

9 . The computer-implemented method of claim 1 , wherein training a large language model further comprises transforming system logs into an embedding layer to preserve relationships between system logs.

10 . A system, comprising:
a memory device; and one or more processor devices operatively coupled with the memory device to:
transform collected system logs into log templates using an optimized parser;
tokenize the log templates partitioned into time windows to obtain log template tokens;
train a language model (LM) with deep learning using the log template tokens to obtain a trained LM;
detect anomalies from system logs using the trained LM to obtain detected anomalies; and
perform a corrective action to a monitored entity based on the detected anomalies.

11 . The system of claim 10 , wherein to perform a corrective action further comprises to update a medical diagnosis of a patient based on the detected anomalies from system logs, that includes healthcare data of the patient, collected from a healthcare data system.

12 . The system of claim 10 , wherein to transform collected system logs further comprises optimizing a parser to eliminate noise and extraneous information from system logs.

13 . The system of claim 10 , wherein to tokenize the log templates further comprises to partition system logs into multiple time windows with a fixed window size to capture unique log sequences within a specific time range.

14 . The system of claim 10 , wherein to train a large language model further comprises to fine-tune the trained LM using incoming system logs to optimize performance and adaptability.

15 . The system of claim 10 , wherein training a large language model further comprises to compute a global loss function that maps log sequences to representation vectors that have an average minimum distances to a center in a latent space in an embedding layer using a recurrent neural network.

16 . The system of claim 15 , wherein training a large language model further comprises computing a local loss function that obtains a sequence of hidden representations that encode sequential dependences in local regions in the latent space.

17 . The system of claim 16 , wherein to train a large language model further comprises to fuse the global loss function and the local loss function to obtain a fused loss function to train the LM using the fused loss function.

18 . The computer-implemented method of claim 1 , wherein training a large language model further comprises transforming system logs into an embedding layer to preserve relationships between system logs.

19 . A non-transitory computer program product comprising a computer-readable storage medium including program code for log representation learning for automated system maintenance, wherein the program code when executed on a computer causes the computer to:
transform collected system logs into log templates using an optimized parser; tokenize the log templates partitioned into time windows to obtain log template tokens; train a language model (LM) with deep learning using the log template tokens to obtain a trained LM; detect anomalies from system logs using the trained LM to obtain detected anomalies; and perform a corrective action to a monitored entity based on the detected anomalies.

20 . The non-transitory computer program product of claim 19 , wherein to perform a corrective action further comprises updating a medical diagnosis of a patient based on the detected anomalies from system logs, that includes healthcare data of the patient, collected from a healthcare data system.

Assignees

• Nec Lab America Inc

Inventors

• Chen Zhengzhang
• Zheng Lecheng
• Chen Haifeng
• Liu Yanchi
• Zhao Xujiang
• Chen Yuncong
• Tang Luan

Classifications

• G06F2201/835

  Timestamp · CPC title

• G06F2201/81

  Threshold · CPC title

• G06F11/3006

  where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50) · CPC title

• G06F11/3476

  Data logging (G06F11/14, G06F11/2205 take precedence) · CPC title

• G06F11/0793 Primary

  Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40) · CPC title