With the expansion of complex IT systems, the volume of generated log data continues to escalate, intensifying the challenges of monitoring and securing these systems. Recent advances in log-based anomaly detection demonstrate effectiveness in leveraging deep learning techniques to answer these challenges. However, most approaches remain limited in their ability to extract complex relationships and understand contextual patterns from log data. In this work, we present a log-based anomaly detection approach based on fine-tuned large language models (LLMs), designed to improve context-aware and intelligent detection methods without using degrading parsing techniques or log templates. The model learns normal behaviors through self-supervised fine-tuning on normal system and network log data, aiming to complete a next log prediction task from a sequence of raw logs. The predicted log is then compared to the ground truth using cosine similarity to assess the deviation from expected behavior and identify anomalies. The experiments showcase notable results on system logs, exceeding state-of-the-art F1 scores with 0.945 on BGL, 0.926 on Thunderbird, and 0.920 on Spirit datasets. Furthermore, despite using a language model, our approach unveils promising results over network logs, mainly composed of numerical values, with an F1 score of 0.957 on NLS-KDD.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Towards Context-Aware Log Anomaly Detection Using Fine-Tuned Large Language Models

  • Hugo Breniaux,
  • Djedjiga Mouheb

摘要

With the expansion of complex IT systems, the volume of generated log data continues to escalate, intensifying the challenges of monitoring and securing these systems. Recent advances in log-based anomaly detection demonstrate effectiveness in leveraging deep learning techniques to answer these challenges. However, most approaches remain limited in their ability to extract complex relationships and understand contextual patterns from log data. In this work, we present a log-based anomaly detection approach based on fine-tuned large language models (LLMs), designed to improve context-aware and intelligent detection methods without using degrading parsing techniques or log templates. The model learns normal behaviors through self-supervised fine-tuning on normal system and network log data, aiming to complete a next log prediction task from a sequence of raw logs. The predicted log is then compared to the ground truth using cosine similarity to assess the deviation from expected behavior and identify anomalies. The experiments showcase notable results on system logs, exceeding state-of-the-art F1 scores with 0.945 on BGL, 0.926 on Thunderbird, and 0.920 on Spirit datasets. Furthermore, despite using a language model, our approach unveils promising results over network logs, mainly composed of numerical values, with an F1 score of 0.957 on NLS-KDD.