LogEncoder: Log-Based Contrastive Representation Learning for Anomaly Detection

Abstract

The increasing volume of log data produced by software-intensive systems makes it impractical to analyze them manually. Many deep learning-based methods have been proposed for log-based anomaly detection. These methods face several challenges such as high-dimensional and noisy log data, class imbalance, generalization, and model interpretability. Recently, ChatGPT has shown promising results in various domains. However, there is still a lack of study on the application of ChatGPT for log-based anomaly detection. In this work, we proposed LogGPT, a log-based anomaly detection framework based on ChatGPT. By leveraging the ChatGPT's language interpretation capabilities, LogGPT aims to explore the transferability of knowledge from large-scale corpora to log-based anomaly detection. We conduct experiments to evaluate the performance of LogGPT and compare it with three deep learning-based methods on BGL and Spirit datasets. LogGPT shows promising results and has good interpretability. This study provides preliminary insights into prompt-based models, such as ChatGPT, for the log-based anomaly detection task.

Severity-Oriented Multiclass Drone Flight Logs Anomaly Detection

“…Common problems encountered in log-based anomaly detection include the unstructured nature of log messages, each system having its own log characteristics, being less humanreadable, and containing many special or technical terms [22], [23]. To deal with these problems, a typical ML/DLbased log-based anomaly detection comprises several stages, i.e., log cleansing, log parsing, feature extraction, model training, model testing, and model evaluation.…”

“…Nevertheless, similar but contradicting log events ended up having features that are close to one another in the latent space. Dealing with such an issue, Qi et al [22] propose a contrastive-based approach which consists of a representation learning model to provide a decent input to a one-class classifier to distinguish the normal from the abnormal log samples. Instead of removing the parameter values in a log message when performing log parsing, the information can be used as an additional feature along with the metadata of the logs to improve the model's performance [19].…”

“…For that reason, a recurrent-based network is employed to capture the sequential dependency and relationship between the log events' occurrences. For instance, an LSTM [22] and GRU [9] model is used to capture the contextual features of the log sequence. The same approach can also be used in a point-based setting, where the sequence of words or parameters in a log message is the features [9].…”

“…In this particular situation, a one-class approach can be used to construct a normal baseline model. During the detection, an anomaly score is used to decide if an input event is anomalous based on a threshold value [20], [22].…”

LogEDL: Log Anomaly Detection via Evidential Deep Learning

“…Log parsing methods, such as Spell [23], IPLoM [24], Drain [25], and so on. According to previous studies [26], weak log parsing methods can negatively affect the performance of subsequent anomaly detection tasks.Drain has become a common method used by researchers with its superior accuracy and efficiency [27,28]. Therefore, in this work, we use Drain for log message parsing.As shown in Figure 2, the HDFS dataset is used as an example.…”