Abstract:With the rapid development of deep learning (DL), the recent trend of log-based anomaly detection focuses on extracting semantic information from log events (i.e., templates of log messages) and designing more advanced DL models for anomaly detection. Indeed, the effectiveness of log-based anomaly detection can be improved, but these DL-based techniques further suffer from the limitations of more heavy dependency on training data (such as data quality or data labels) and higher costs in time and resources due to the complexity and scale of DL models, which hinder their practical use. On the contrary, the techniques based on traditional machine learning or data mining algorithms are less dependent on training data and more efficient, but produce worse effectiveness than DL-based techniques which is mainly caused by the problem of unseen log events (some log events in incoming log messages are unseen in training data) confirmed by our motivating study. Intuitively, if we can improve the effectiveness of traditional techniques to be comparable with advanced DL-based techniques, log-based anomaly detection can be more practical. Indeed, an existing study in the other area (i.e., linking questions posted on Stack Overflow) has pointed out that traditional techniques with some optimizations can indeed achieve comparable effectiveness with the state-of-the-art DL-based technique, indicating the feasibility of enhancing traditional log-based anomaly detection techniques to some degree. Inspired by the idea of “try-with-simpler”, we conducted the first empirical study to explore the potential of improving traditional techniques for more practical log-based anomaly detection. In this work, we optimized the traditional unsupervised PCA (Principal Component Analysis) technique by incorporating a lightweight semantic-based log representation in it, called SemPCA , and conducted an extensive study to investigate the potential of SemPCA for more practical log-based anomaly detection. By comparing seven log-based anomaly detection techniques (including four DL-based techniques, two traditional techniques, and SemPCA ) on both public and industrial datasets, our results show that SemPCA achieves comparable effectiveness as advanced supervised/semi-supervised DL-based techniques while being much more stable under insufficient training data and more efficient, demonstrating that the traditional technique can still excel after small but useful adaptation.

Try with Simpler -- An Evaluation of Improved Principal Component Analysis in Log-based Anomaly Detection

Try with Simpler – An Evaluation of Improved Principal Component Analysis in Log-based Anomaly Detection

Improving Log-Based Anomaly Detection with Component-Aware Analysis

Experience Report: Deep Learning-based System Log Analysis for Anomaly Detection

AIOps-Driven Enhancement of Log Anomaly Detection in Unsupervised Scenarios

Natural Language Processing-based Model for Log Anomaly Detection

Analyzing and Improving Supervised Nonlinear Dynamical Probabilistic Latent Variable Model for Inferential Sensors

SSDLog: a semi-supervised dual branch model for log anomaly detection

LogPS: A Robust Log Sequential Anomaly Detection Approach Based on Natural Language Processing

LogAnomaly: Unsupervised Detection of Sequential and Quantitative Anomalies in Unstructured Logs

LogCAE: an Approach for Log-based Anomaly Detection with Active Learning and Contrastive Learning

Discrete Robust Principal Component Analysis Via Binary Weights Self-Learning

Log-based Anomaly Detection with Deep Learning: How Far Are We?

Deep Learning for Anomaly Detection in Log Data: A Survey

Deep Learning-based Anomaly Detection and Log Analysis for Computer Networks

Improving Performance of Log Anomaly Detection with Semantic and Time Features Based on BiLSTM-Attention

LogOnline: A Semi-Supervised Log-Based Anomaly Detector Aided with Online Learning Mechanism.

On the Influence of Data Resampling for Deep Learning-Based Log Anomaly Detection: Insights and Recommendations

DualAttlog: Context aware dual attention networks for log-based anomaly detection

End-to-End AutoML for Unsupervised Log Anomaly Detection

A Robust Wide & Deep Learning Framework for Log-Based Anomaly Detection