Abstract:Logs are prevalent in modern cloud systems and serve as a valuable source of information for system maintenance. Over the years, a lot of research and industrial efforts have been devoted to the field of log-based anomaly detection. Through analyzing the limitations of existing approaches, we find that most of them still suffer from practical issues and are thus hard to be applied in real-world scenarios. For example, supervised approaches are dependent on a large amount of labeled log data for training, which can require much manual labeling effort. Besides, log instability, which is a pervasive issue in real-world systems, poses great challenge to existing methods, especially under the presence of many dissimilar new log events. To overcome these problems, we propose LogOnline, which is a semi supervised anomaly detector aided with online learning mechanism. The semi-supervised nature of LogOnline makes it able to get rid of the erroneous and time-consuming manual labeling of log data. Based on our proposed online learning mechanism, LogOnline can learn the normal sequence patterns continuously as new log sequences emerge, thus staying robust to unstable log data. Unlike previous works, the proposed online learning mechanism requires no labeled log data nor human intervention in the process. We have evaluated LogOnline on two widely used public datasets, and the experimental results demonstrate the effectiveness of LogOnline. In particular, LogOnline achieves a comparable result with the studied supervised approaches, outperforming all semi-supervised counterparts. When the log instability issue is more common, LogOnline exhibits the best performance over all compared approaches, further confirming its practicability.

AFALog: A General Augmentation Framework for Log-based Anomaly Detection with Active Learning

AcLog: an Approach to Detecting Anomalies from System Logs with Active Learning

LogCAE: an Approach for Log-based Anomaly Detection with Active Learning and Contrastive Learning

Leveraging RAG-Enhanced Large Language Model for Semi-Supervised Log Anomaly Detection

LLMeLog: an Approach for Anomaly Detection Based on LLM-enriched Log Events

Augmenting Log-based Anomaly Detection Models to Reduce False Anomalies with Human Feedback

LogRAG: Semi-Supervised Log-based Anomaly Detection with Retrieval-Augmented Generation

OMLog: Online Log Anomaly Detection for Evolving System with Meta-learning

MetaLog: Generalizable Cross-System Anomaly Detection from Logs with Meta-Learning.

MDFULog: Multi-Feature Deep Fusion of Unstable Log Anomaly Detection Model

Deep Anomaly Detection Via Active Anomaly Search.

ADA: Adaptive Deep Log Anomaly Detector

LogOnline: A Semi-Supervised Log-Based Anomaly Detector Aided with Online Learning Mechanism.

Machine Learning Based Anomaly Detection of Log Files Using Ensemble Learning and Self-Attention

SSDLog: a semi-supervised dual branch model for log anomaly detection

LogAnomaly: Unsupervised Detection of Sequential and Quantitative Anomalies in Unstructured Logs

FastLogAD: Log Anomaly Detection with Mask-Guided Pseudo Anomaly Generation and Discrimination

Little Help Makes a Big Difference: Leveraging Active Learning to Improve Unsupervised Time Series Anomaly Detection

Federated Anomaly Detection on System Logs for the Internet of Things: A Customizable and Communication-Efficient Approach

Self-supervision Meets Adversarial Perturbation: A Novel Framework for Anomaly Detection

DualAttlog: Context aware dual attention networks for log-based anomaly detection