Abstract:Log data are generated from logging statements in the source code, providing insights into the execution processes of software applications and systems. State-of-the-art log-based anomaly detection approaches typically leverage deep learning models to capture the semantic or sequential information in the log data and detect anomalous runtime behaviors. However, the impacts of these different types of information are not clear. In addition, existing approaches have not captured the timestamps in the log data, which can potentially provide more fine-grained temporal information than sequential information. In this work, we propose a configurable transformer-based anomaly detection model that can capture the semantic, sequential, and temporal information in the log data and allows us to configure the different types of information as the model's features. Additionally, we train and evaluate the proposed model using log sequences of different lengths, thus overcoming the constraint of existing methods that rely on fixed-length or time-windowed log sequences as inputs. With the proposed model, we conduct a series of experiments with different combinations of input features to evaluate the roles of different types of information in anomaly detection. When presented with log sequences of varying lengths, the model can attain competitive and consistently stable performance compared to the baselines. The results indicate that the event occurrence information plays a key role in identifying anomalies, while the impact of the sequential and temporal information is not significant for anomaly detection in the studied public datasets. On the other hand, the findings also reveal the simplicity of the studied public datasets and highlight the importance of constructing new datasets that contain different types of anomalies to better evaluate the performance of anomaly detection models.

HitAnomaly: Hierarchical Transformers for Anomaly Detection in System Log

Natural Language Processing-based Model for Log Anomaly Detection

LogAnomaly: Unsupervised Detection of Sequential and Quantitative Anomalies in Unstructured Logs

What Information Contributes to Log-based Anomaly Detection? Insights from a Configurable Transformer-Based Approach

An Anomaly Detection Approach of Part-of-Speech Log Sequence Via Population Based Training

LogFormer: A Pre-train and Tuning Pipeline for Log Anomaly Detection

An Intelligent Framework for Log Anomaly Detection Based on Log Template Extraction

Log-based Anomaly Detection Without Log Parsing

TPLogAD: Unsupervised Log Anomaly Detection Based on Event Templates and Key Parameters

LogPal: A Generic Anomaly Detection Scheme of Heterogeneous Logs for Network Systems

Improving Log-Based Anomaly Detection by Pre-Training Hierarchical Transformers

Log Sequence Anomaly Detection Based on Local Information Extraction and Globally Sparse Transformer Model

ConAnomaly: Content-Based Anomaly Detection for System Logs

Improving Performance of Log Anomaly Detection with Semantic and Time Features Based on BiLSTM-Attention

TPLAD: Template-Parsed Log Anomaly Detection for Electrical Database Systems

Multi-source data based anomaly detection through temporal and spatial characteristics

Machine Learning Based Anomaly Detection of Log Files Using Ensemble Learning and Self-Attention

LGAT: A Novel Model for Multivariate Time Series Anomaly Detection with Imporved Anomaly Transformer and Learning Graph Structures

A Convolutional Auto-Encoder Method for Anomaly Detection on System Logs

An Integrated Method for Anomaly Detection From Massive System Logs.

Distributed system anomaly detection using deep learning‐based log analysis