公开(公告)号：US20240118957A1

公开(公告)日：2024-04-11

申请号：US18465074

申请日：2023-09-11

Applicant: Nokia Solutions and Networks Oy

Inventor： Péter SZILÁGYI ,  Gabor HORVATH ,  Attila KADAR

IPC: G06F11/07

CPC classification number: G06F11/0751 ,  G06F11/0769

Abstract: Converting each log of a sequence of N logs into an identifier among K different identifiers to obtain a sequence of N identifiers;



for each n between 0 and N:

for each K identifier: counting occurrences of the identifier among the first n identifiers of the sequence to obtain a front frequency of the identifier for the respective n; and
for each K identifier: counting occurrences of the identifier among the last N−n identifiers of the sequence to obtain a rear frequency of the identifier for the respective n;
arranging front frequencies and rear frequencies in a count vector;
inputting the count vector an autoencoder to obtain an output vector for the respective n;
determining a difference between the output vector and the count vector;
marking the sequence as anomalous if the difference between the output vector and the count vector is larger than a threshold.

公开(公告)号：US20230412627A1

公开(公告)日：2023-12-21

申请号：US18188677

申请日：2023-03-23

Applicant: Nokia Solutions and Networks Oy

Inventor： Péter SZILÁGYI ,  Gabor HORVATH ,  Attila KADAR

IPC: H04L9/40 ,  G06F40/30

CPC classification number: H04L63/1425 ,  G06F40/30

Abstract: An apparatus for anomaly detection, the apparatus comprising means for:



Collecting a plurality of log messages from a data processing system, log messages comprising textual content and numeric attributes,
Classifying the plurality of log messages into a plurality of clusters as a function of a number of the numeric attributes in the log messages, such that the log messages within a cluster have a given number of the numeric attributes,
For at least one of the clusters, computing at least one encoding vector associated to a numeric attribute,
Computing a combined semantic embedding vector from the textual contents of the plurality of log messages,
Combining the at least one encoding vector with the combined semantic embedding vector into a final encoding vector, and
Feeding the final encoding vector to an anomaly detection module intended to detect an anomaly in the data processing system.