Log-based anomaly detection is critical for ensuring software system reliability and security. The Generalizable Cross-System Log Anomaly Detection (GCLAD) problem, requiring models to adapt from mature systems with abundant labeled data to new systems with limited labeled logs, remains challenging. While MetaLog, a meta-learning based approach, has shown promising results, its aggregation of event embeddings uses equal weighting for all events, ignoring their varying diagnostic importance. This paper introduces AutoWeighted MetaLog, which enhances MetaLog through automated weight learning for log sequence representation. Our approach employs a Transformer-based model to automatically learn event weights without requiring ground truth labels during inference or manual weighting in real deployment. Building on initial static-weighting validation (which improved F1-score from \(84.23\%\) to \(87.73\%\) ), our automated method achieves an F1-score of \(86.12\%\)  under the original GCLAD setting, retaining the gain while remaining fully deployable. This work proposes a practical solution for enhancing cross-system anomaly detection through automated weight learning for log sequence representation.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

AutoWeighted MetaLog Dynamic Representation for Cross-System Anomaly Detection

  • Cao Manh Quyet,
  • Cao Van Loi,
  • Nguyen Hai Nam,
  • Vo Minh Thien Long

摘要

Log-based anomaly detection is critical for ensuring software system reliability and security. The Generalizable Cross-System Log Anomaly Detection (GCLAD) problem, requiring models to adapt from mature systems with abundant labeled data to new systems with limited labeled logs, remains challenging. While MetaLog, a meta-learning based approach, has shown promising results, its aggregation of event embeddings uses equal weighting for all events, ignoring their varying diagnostic importance. This paper introduces AutoWeighted MetaLog, which enhances MetaLog through automated weight learning for log sequence representation. Our approach employs a Transformer-based model to automatically learn event weights without requiring ground truth labels during inference or manual weighting in real deployment. Building on initial static-weighting validation (which improved F1-score from \(84.23\%\) to \(87.73\%\) ), our automated method achieves an F1-score of \(86.12\%\)  under the original GCLAD setting, retaining the gain while remaining fully deployable. This work proposes a practical solution for enhancing cross-system anomaly detection through automated weight learning for log sequence representation.