Log-based anomaly detection is vital for identifying system failures as well as early attacks. However, analyzing logs and identifying anomalies from new deployment systems often face challenges due to insufficient labeled log data, particularly anomalies, which can diminish the effectiveness of supervised learning approaches. In this paper, we introduce a novel cross-system log-based anomaly detection method, termed Log Representation Transferable - LogReT. This method harnesses prior knowledge from established systems and integrates a small number of logs (with few anomalies) from the new system to improve its adaptation ability to the cross systems. Our method employs a shared Long Short-Term Memory model to learn representations that effectively distinguish between normal and anomalous log data, while ensuring that normal logs are consistently mapped cross systems. Experimental results on the BGL and Thunderbird log datasets indicate that LogReT frequently surpasses recent log-based anomaly detection methods. This demonstrates significant promise for log anomaly detection in cross-system contexts with few anomalous samples.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Log-Based Representation Transferable Learning for Cross-System Anomaly Detection

  • Manh-Tuan Nguyen,
  • Trang-Dang Le Dinh,
  • Van Loi Cao

摘要

Log-based anomaly detection is vital for identifying system failures as well as early attacks. However, analyzing logs and identifying anomalies from new deployment systems often face challenges due to insufficient labeled log data, particularly anomalies, which can diminish the effectiveness of supervised learning approaches. In this paper, we introduce a novel cross-system log-based anomaly detection method, termed Log Representation Transferable - LogReT. This method harnesses prior knowledge from established systems and integrates a small number of logs (with few anomalies) from the new system to improve its adaptation ability to the cross systems. Our method employs a shared Long Short-Term Memory model to learn representations that effectively distinguish between normal and anomalous log data, while ensuring that normal logs are consistently mapped cross systems. Experimental results on the BGL and Thunderbird log datasets indicate that LogReT frequently surpasses recent log-based anomaly detection methods. This demonstrates significant promise for log anomaly detection in cross-system contexts with few anomalous samples.