Abstract:The rapid growth of deep learning (DL) has spurred interest in enhancing log-based anomaly detection. This approach aims to extract meaning from log events (log message templates) and develop advanced DL models for anomaly detection. However, these DL methods face challenges like heavy reliance on training data, labels, and computational resources due to model complexity. In contrast, traditional machine learning and data mining techniques are less data-dependent and more efficient but less effective than DL. To make log-based anomaly detection more practical, the goal is to enhance traditional techniques to match DL's effectiveness. Previous research in a different domain (linking questions on Stack Overflow) suggests that optimized traditional techniques can rival state-of-the-art DL methods. Drawing inspiration from this concept, we conducted an empirical study. We optimized the unsupervised PCA (Principal Component Analysis), a traditional technique, by incorporating lightweight semantic-based log representation. This addresses the issue of unseen log events in training data, enhancing log representation. Our study compared seven log-based anomaly detection methods, including four DL-based, two traditional, and the optimized PCA technique, using public and industrial datasets. Results indicate that the optimized unsupervised PCA technique achieves similar effectiveness to advanced supervised/semi-supervised DL methods while being more stable with limited training data and resource-efficient. This demonstrates the adaptability and strength of traditional techniques through small yet impactful adaptations.

Improving Log-Based Anomaly Detection with Component-Aware Analysis

LogAnomaly: Unsupervised Detection of Sequential and Quantitative Anomalies in Unstructured Logs

Natural Language Processing-based Model for Log Anomaly Detection

LogCAE: an Approach for Log-based Anomaly Detection with Active Learning and Contrastive Learning

An Anomaly Detection Approach of Part-of-Speech Log Sequence Via Population Based Training

Improving Performance of Log Anomaly Detection with Semantic and Time Features Based on BiLSTM-Attention

CSCLog: A Component Subsequence Correlation-Aware Log Anomaly Detection Method

A LSTM-Based Anomaly Detection Model for Log Analysis

LogPS: A Robust Log Sequential Anomaly Detection Approach Based on Natural Language Processing

AcLog: an Approach to Detecting Anomalies from System Logs with Active Learning

AutoLog: A Log Sequence Synthesis Framework for Anomaly Detection

Try with Simpler -- An Evaluation of Improved Principal Component Analysis in Log-based Anomaly Detection

LLMeLog: an Approach for Anomaly Detection Based on LLM-enriched Log Events

Log-based Anomaly Detection Without Log Parsing

Log-based Anomaly Detection based on EVT Theory with feedback

Experience Report: Deep Learning-based System Log Analysis for Anomaly Detection

A Robust Wide & Deep Learning Framework for Log-Based Anomaly Detection

End-to-End AutoML for Unsupervised Log Anomaly Detection

DualAttlog: Context aware dual attention networks for log-based anomaly detection

Log-Based Anomaly Detection with Multi-Head Scaled Dot-Product Attention Mechanism

Anomaly Detection Model for Log Based on LSTM Network and Variational Autoencoder