The rapid expansion of the Internet of Things (IoT) and the growing interconnectivity of industrial systems have created an urgent need for log anomaly detection (LAD) to be performed locally on edge devices. However, a significant gap exists between the computational resources required by advanced deep learning models and the limited processing capacity of edge hardware, often forcing a trade-off between detection accuracy and deployment feasibility. To address this challenge, this paper makes two major contributions. First, we introduce EM-AT-based LAD by designing an unsupervised LAD method that extends the Transformer-based anomaly detection model via integrating the Expectation-Maximization (EM) algorithm for fully automated threshold determination. While EM-AT-based LAD achieves high detection accuracy, its computational requirement limits its direct applicability on power-constrained edge devices. Therefore, we introduce LiteLADR, a framework that enables efficient system log analysis via quantized on-device anomaly detection and response. LiteLADR leverages TorchAO and ExecuTorch for model quantization and optimization, enabling both EM-AT and large language models (LLMs) to operate efficiently on resource-constrained edge nodes. Comprehensive evaluations on the HDFS and OpenStack datasets show that EM-AT outperforms leading methods, achieving \(F_{1}\) -scores of 98.90% and 99.61%, respectively. LiteLADR preserves strong detection performance ( \(F_{1}\) -scores of 98.65% and 99.43%) while substantially reducing computational resource consumption.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Efficient System Log Analysis via Quantized On-Device Anomaly Detection and Response

  • Qinxuan Shi,
  • Zhanglong Yang,
  • Sicong Shao

摘要

The rapid expansion of the Internet of Things (IoT) and the growing interconnectivity of industrial systems have created an urgent need for log anomaly detection (LAD) to be performed locally on edge devices. However, a significant gap exists between the computational resources required by advanced deep learning models and the limited processing capacity of edge hardware, often forcing a trade-off between detection accuracy and deployment feasibility. To address this challenge, this paper makes two major contributions. First, we introduce EM-AT-based LAD by designing an unsupervised LAD method that extends the Transformer-based anomaly detection model via integrating the Expectation-Maximization (EM) algorithm for fully automated threshold determination. While EM-AT-based LAD achieves high detection accuracy, its computational requirement limits its direct applicability on power-constrained edge devices. Therefore, we introduce LiteLADR, a framework that enables efficient system log analysis via quantized on-device anomaly detection and response. LiteLADR leverages TorchAO and ExecuTorch for model quantization and optimization, enabling both EM-AT and large language models (LLMs) to operate efficiently on resource-constrained edge nodes. Comprehensive evaluations on the HDFS and OpenStack datasets show that EM-AT outperforms leading methods, achieving \(F_{1}\) -scores of 98.90% and 99.61%, respectively. LiteLADR preserves strong detection performance ( \(F_{1}\) -scores of 98.65% and 99.43%) while substantially reducing computational resource consumption.