Abstract:Log messages provide a valuable source of runtime information for ensuring the safety and consistency of systems. Recently, many machine learning and deep learning methods have been proposed to automatically detect anomalous log messages, obviating the need for manual detection by experts. However, we find that in practice, the effectiveness of existing learning-based methods is severely affected by incomplete information and distribution shift. Specifically, each log message can actually be parsed into a fixed number of key information fields, while existing methods analyze log messages using only the log event information and ignore other useful information fields that can be critical to anomaly detection. Further, the distribution of real-world log messages changes continuously due to the dynamic nature of the runtime environment and thus, a detection model conventionally trained based on the unrealistic i.i.d. assumption may not provide the expected and consistent performance. In this paper, we present a robust and transferable anomaly detection framework RT-Log to address the above problems. To perform a comprehensive analysis of log messages, we introduce an adaptive relation modeling technique, which captures feature interactions among log information fields selectively and dynamically for effective and interpretable log representations. To establish its robustness and transferability, we propose a general environment generalization technique for learning the environment invariant representations that can generalize across different runtime environments. We evaluate the anomaly detection performance of RT-Log on large real-world datasets. Extensive experimental results demonstrate that RT-Log consistently outperforms state-of-the-art methods by a significant margin under different settings.

LogBERT: Log Anomaly Detection via BERT

LAnoBERT: System Log Anomaly Detection based on BERT Masked Language Model

BertHTLG: Graph-Based Microservice Anomaly Detection Through Sentence-Bert Enhancement.

Leveraging Large Language Models and BERT for Log Parsing and Anomaly Detection

Log Anomaly Detection method based on BERT model optimization

Research on Log Anomaly Detection Based on Sentence-BERT

BERT-Log: Anomaly Detection for System Logs Based on Pre-trained Language Model

SemLog: A Semantics-based Approach for Anomaly Detection in Big Data System Logs

LogBD: A Log Anomaly Detection Method Based on Pretrained Models and Domain Adaptation

LogST: Log Semi-supervised Anomaly Detection Based on Sentence-BERT

LLMeLog: an Approach for Anomaly Detection Based on LLM-enriched Log Events

Improving Log-Based Anomaly Detection by Pre-Training Hierarchical Transformers

LogLLM: Log-based Anomaly Detection Using Large Language Models

Robust and Transferable Anomaly Detection in Log Data using Pre-Trained Language Models

CLDTLog: System Log Anomaly Detection Method Based on Contrastive Learning and Dual Objective Tasks

Natural Language Processing-based Model for Log Anomaly Detection

Log Sequence Anomaly Detection Method Based on Contrastive Adversarial Training and Dual Feature Extraction

LogAnomaly: Unsupervised Detection of Sequential and Quantitative Anomalies in Unstructured Logs

Robust and Transferable Log-based Anomaly Detection.

An Anomaly Detection Approach of Part-of-Speech Log Sequence Via Population Based Training

PoSBert: Log Classification Via Modified Bert Based on Part-of-Speech Weight