计算机与现代化 ›› 2025, Vol. 0 ›› Issue (08): 39-47.doi: 10.3969/j.issn.1006-2475.2025.08.006

• 人工智能 • 上一篇    下一篇

基于图神经网络的异常事件预测方法

  


  1. (国网江苏省电力有限公司电力科学研究院,江苏 南京 211103) 
  • 出版日期:2025-08-27 发布日期:2025-08-27
  • 作者简介: 作者简介:李岩(1990 —),男,山东曲阜人,高级工程师,硕士,研究方向:网络安全,E-mail: sdqfnqly2008@163.com; 冒佳明(1991—),男,江苏泰州人,高级工程师,硕士,研究方向:网络安全,E-mail: hufimao@163.com; 王梓莹(1991—),女,江苏兴化人,工程师,硕士,研究方向:网络安全,E-mail: wangziying1008@126.com; 顾智敏(1993—),女,江苏南通人,工程师,硕士,研究方向:电力系统网络安全,E-mail: guzmdw@163.com; 姜海涛(1985—),男,江苏南京人,高级工程师,博士,研究方向:网络安全,E-mail: jianghaitaoxin@163.com。
  • 基金资助:
     基金项目:国网江苏省电力有限公司科技项目(J2023180)
       

Anomalous Event Prediction Approach Using Graph Neural Network


  1. (Electric Power Research Institute, State Grid Jiangsu Electric Power Co., Ltd., Nanjing 211103, China)
  • Online:2025-08-27 Published:2025-08-27

摘要: 摘要:面向日志的异常事件预测可以为复杂系统的安全诊断、智能运维等提供重要支撑。针对现有主流的基于深度学习技术的异常事件预测方法多数从事件序列局部视角捕获序列特征且特征类型较为单一而导致预测准确性不高的问题,提出一种基于图神经网络的异常事件预测方法。该方法将日志事件序列建模为日志事件作为节点而事件间关系作为边的图结构,使之能同时从语义角度、统计角度和事件关系角度刻画日志序列并捕获其时空动态特征以提升预测性能。在此基础上,将异常预测任务转化为图分类问题,通过图神经网络训练建立基于图同构网络的异常预测模型,捕捉故障发生前的日志序列与正常状态下日志序列的差异以进一步提升异常预测性能。在3个基准数据集上进行了实验验证,结果表明提出的方法获得的平均F1值为0.958,优于对比方法,能准确地预测异常事件,实现预警。



关键词: 关键词:日志解析, 异常预测, 图神经网络, 事件挖掘

Abstract:
Abstract: Log-oriented anomalous event prediction provides important support for security diagnosis, intelligent operation and maintenance of complex systems. Most of the existing mainstream anomalous event prediction methods based on deep learning technology capture sequence features from the local perspective of event sequence segments and the feature types are relatively single, resulting in low prediction accuracy. To solve this problem, an anomalous event prediction method based on graph neural network is proposed. The log sequence is represented as a graph structure with log events as nodes and the relationship between events as edges, so that it can simultaneously depict the log sequence from the perspective of semantics, statistics and event relationship to capture its spatio-temporal dynamic characteristics to improve the prediction performance. On this basis, the anomaly prediction task is transformed into a graph classification problem, and an anomaly prediction model based on graph isomorphic network is established by training graph neural network, which can more accurately capture the difference between the log sequence before the failure and the log sequence under normal conditions, and further improve the performance of anomaly prediction. The experimental results on three benchmark datasets show that the average F1 of the proposed method is 0.958, which is better than the comparison methods, and it can accurately predict anomalous events for early warning.

Key words: Key words: log parsing, anomaly prediction, graph neural network, event mining

中图分类号: