Log-Based Representation Transferable Learning for Cross-System Anomaly Detection
摘要
Log-based anomaly detection is vital for identifying system failures as well as early attacks. However, analyzing logs and identifying anomalies from new deployment systems often face challenges due to insufficient labeled log data, particularly anomalies, which can diminish the effectiveness of supervised learning approaches. In this paper, we introduce a novel cross-system log-based anomaly detection method, termed Log Representation Transferable - LogReT. This method harnesses prior knowledge from established systems and integrates a small number of logs (with few anomalies) from the new system to improve its adaptation ability to the cross systems. Our method employs a shared Long Short-Term Memory model to learn representations that effectively distinguish between normal and anomalous log data, while ensuring that normal logs are consistently mapped cross systems. Experimental results on the BGL and Thunderbird log datasets indicate that LogReT frequently surpasses recent log-based anomaly detection methods. This demonstrates significant promise for log anomaly detection in cross-system contexts with few anomalous samples.