Improving Log-Based Anomaly Detection with Deep Learning Models
摘要
System logs are an important resource for checking the health, reliability, and security of large-scale pieces of software. The volume and complexity of contemporary logs have made manual inspection impossible. Therefore, the development of automated anomaly detection methods became necessary. In recent years, deep learning-based methods have gained traction with the introduction of models like DeepLog, LogAnomaly, and LogBERT as three generations of advancement in this field. This paper aims to improve and compare these three techniques via two commonly existing benchmarks HDFS and BGL. The DeepLog model does sequential modeling of logs through Long Short-Term Memory (LSTM) models. The LogAnomaly model uses semantic representations and then quantitative representations to detect unsupervised anomalies. The LogBERT model leverages transformer-based architectures with self-supervised learning to capture contextual dependencies. We measure their performances based on some metrics like Matthews Correlation Coefficient. The experimental results show that LogAnomaly achieves a strong balance of accuracy and robustness, DeepLog is solid at sequentially detecting anomalies, but is less performant for quantitative phenomena, and LogBERT offers state-of-the-art detection but is more computationally expensive. Overall, the results demonstrate the balance between the accuracy, generalizability, and efficiency of these models, helping researchers choose models that best reflect the practical use case of log anomaly detection.