基于结构知识增强的网络设备日志理解方法

Structural Knowledge-Enhanced Approach for Network Device Log Understanding

摘要: 随着网络系统规模和复杂性的不断增长，系统日志已成为故障诊断和运维管理的重要数据源。然而，现有的日志理解方法普遍忽视了日志文本的结构化特征以及系统组件间的关联关系，导致在复杂故障场景下的理解能力有限。为解决这一问题，本文提出了一种基于结构知识增强的网络设备日志理解方法。首先，我们构建了包含设施–错误–严重性三层语义关系的日志知识图谱，显式建模系统组件间的故障传播路径和依赖关系。在此基础上，设计了结构化掩码预测任务，通过对日志中的关键结构化字段采用更高的掩码概率，引导模型重点学习系统架构和错误类型的语义表示。同时，提出了图神经网络增强的文本对齐机制，并通过自注意力机制动态融合多实体图嵌入，实现知识图谱结构信息与文本语义的有效对齐。实验结果表明，所提的方法在多个任务指标上显著优于主流基线模型，验证了其各任务下的有效性与泛化能力。

Abstract: With the continuous growth in scale and complexity of network systems, system logs have become an important data source for fault diagnosis and operations management. However, existing log understanding methods generally neglect the structured characteristics of log texts and the associative relationships among system components, resulting in limited understanding capabilities in complex fault scenarios. To address this issue, this paper proposes a structural knowledge-enhanced approach for network device log understanding. First, we construct a log knowledge graph encompassing three-layer semantic relationships of facility-error-severity, explicitly modeling fault propagation paths and dependency relationships among system components. Building upon this foundation, we design a structured masking prediction task that employs higher masking probabilities for key structured fields in logs, guiding the model to focus on learning semantic representations of system architecture and error types. Meanwhile, we propose a graph neural network-enhanced text alignment mechanism that dynamically fuses multi-entity graph embeddings through self-attention mechanisms, achieving effective alignment between knowledge graph structural information and textual semantics. Experimental results demonstrate that the proposed method significantly outperforms mainstream baseline models across multiple task metrics, validating its effectiveness and generalization capability across various tasks.