Log Anomaly Detection Based on Time-Delta Sequential Feature
摘要
In large-scale and complex software systems, log data has grown explosively, making manual anomaly detection methods increasingly infeasible. While recent deep learning approaches have made significant progress in log anomaly detection, most of them focus only on log event sequences and overlook valuable temporal information. To address this issue, we propose TDoSLog, an anomaly detection method based on Time-Delta Sequential features. TDoSLog utilizes both the sequence of log events and the sequence of timestamp intervals between adjacent log messages. To encode the time-delta features effectively, we introduce two vectorization strategies: interval-based segmentation and k-means-based clustering. These features are then processed by two parallel two-layer Bi-LSTM networks, and their outputs are fused via a fully connected neural network to perform final anomaly prediction. Experimental results on two public datasets, BGL and HDFS, demonstrate that TDoSLog achieves state-of-the-art performance, with F1-scores up to 98.9% and 96.3%, respectively.