Log Message Anomaly Detection and Classification Using Auto-B/LSTM and Auto-GRU

Abstract

Log messages are now widely used in software systems. They are important for classification as millions of logs are generated each day. Most logs are unstructured which makes classification a challenge. In this paper, Deep Learning (DL) methods called Auto-LSTM, Auto-BLSTM and Auto-GRU are developed for anomaly detection and log classification. These models are used to convert unstructured log data to trained features which is suitable for classification algorithms. They are evaluated using four data sets, namely BGL, Openstack, Thunderbird and IMDB.The first three are popular log data sets while the fourth is a movie review data set which is used for sentiment classification and is used here to show that the models can be generalized to other text classification tasks. The results obtained show that Auto-LSTM, Auto-BLSTM and Auto-GRU perform better than other well-known algorithms.

Deep Learning for Anomaly Detection in Log Data: A Survey

“…Some approaches make use of Bi-LSTM RNNs, which are basically two independent LSTM RNNs that work in parallel and process sequences in opposite directions, i.e., while one LSTM RNN processes the input sequences as usual from the first to the last element, the other LSTM RNN processes sequence elements starting from the last entry and predicts elements that chronologically precede them. Experiments suggest that Bi-LSTM RNNs outperform LSTM RNNs [17], [34], [46], [50], [55], [57], [72], [75]. Another popular choice for RNNs are Gated Recurrent Units (GRU) that simplify the cell architecture as they only rely on update and reset gates.…”

“…Another popular choice for RNNs are Gated Recurrent Units (GRU) that simplify the cell architecture as they only rely on update and reset gates. One of the main benefits of GRUs is that they are computationally more efficient than LSTM RNNs, which is a relevant aspect for use cases focusing on edge devices [21], [34], [35], [37], [53], [56], [62], [68], [69].…”

“…-Failures [24], [34]- [36], [38]- [41], [55], [60], [64], [71], [73] OpenStack [20] 2017 Virtual machines Failures [20], [26], [34]- [36], [42], [44], [50], [52], [63], [76]- [78] Hadoop [90] 2016 High-perf. comp.…”

“…2) Evaluation metrics: Quantitative evaluation (ER-2) of anomaly detection approaches typically revolves around counting the numbers of correctly detected anomalous samples as true positives (T P ), incorrectly detected non-anomalous samples as false positives (F P ), incorrectly undetected anomalous samples as false negatives (F N ), and correctly undetected non-anomalous samples as true negatives (T N ). In the most basic setting where events are labeled individually and samples represent single events (e.g., as in the BGL data set), it is relatively straightforward to evaluate detected events with binary classification [34], [36]. Some of the reviewed papers additionally consider a multi-class classification problem for data sets where different types of failures have distinct labels by computing the averages of evaluation metrics over all classes [55] or plotting confusion matrices [32].…”