Self-Attentive Classification-Based Anomaly Detection in Unstructured Logs

Nedelkoski, Sasho; Bogatinovski, Jasmin; Acker, Alexander; Cardoso, Jorge; Kao, Odej

doi:10.1109/icdm50108.2020.00148

Cited by 86 publications

(57 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There are several categorization of the existing anomaly detection techniques, but one can confine them into; log template or key based, log semantic-based under the hood of supervised, and unsupervised methods [12], [15]- [18]. Key-based methods use log parsing tools to overcome free text problem and identify structured versions of logs as a template.…”

Section: Background and Related Workmentioning

confidence: 99%

“…Drain, named Drain3 with Python3 compatibility update 1 , is an online tree based parser with specific written rules [25]. Several setbacks appear in utilizing parser: requiring manual configurations and controlling rules become complexier, wrong parsed logs create false alarms due to the inability in capturing parameter values or actions [15], and acquired templates can cause loss of information [18]. Recent studies have mainly focused on capturing semantics from logs using pretrained embeddings to overcome these problems.…”

Section: Background and Related Workmentioning

confidence: 99%

“…In anomaly detection studies, HitAnomaly [15] uses BERT for gathering word vector representations to build log sequence embeddings, then uses the information to distinguish anomalies within hierarchical transformer blocks. Logsy [18] uses its own tokenization method and creates a log vector token that is similar to '[CLS]' token presented in BERT paper. It represents a summary of a log event and identifies anomalous behavior with a transformer model.…”

Section: Background and Related Workmentioning

confidence: 99%

“…Identifying anomalous behavior differs in sources and also is challenging considering streaming data in an online setting. Therefore, detecting anomalous events accurately and timely is crucial [18]. Log is accepted as an universal indicator of events for debugging and analysis purposes.…”

Section: Introductionmentioning

confidence: 99%

“…HitAnomaly [15] indicates the instability of log parsing tools and combines semantic information with log's parameter values. Another recent work, Logsy [18] removes the need of log parsing tools to prevent information loss in yielding templates and uses transformer model with a multi-head attention mechanism. To achieve that, these semantic-based works utilize a pretrained embedding to transfer knowledge into anomaly detection task.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

AnomalyAdapters: Parameter-Efficient Multi-Anomaly Task Detection

Ünal

Dağ

2022

IEEE Access

View full text Add to dashboard Cite

The emergence of technological innovations brings sophisticated threats. Cyberattacks are increasing day by day aligned with these innovations and entails rapid solutions for defense mechanisms. These attacks may hinder enterprise operations or more importantly, interrupt critical infrastructure systems, that are essential to safety, security, and well-being of a society. Anomaly detection, as a protection step, is significant for ensuring a system security. Logs, which are accepted sources universally, are utilized in system health monitoring and intrusion detection systems. Recent developments in Natural Language Processing (NLP) studies show that contextual information decreases false-positives yield in detecting anomalous behaviors. Transformers and their adaptations to various language understanding tasks exemplify the enhanced ability to extract this information. Deep network based anomaly detection solutions use generally feature-based transfer learning methods. This type of learning presents a new set of weights for each log type. It is unfeasible and a redundant way considering various log sources. Also, a vague representation of model decisions prevents learning from threat data and improving model capability. In this paper, we propose AnomalyAdapters (AAs) which is an extensible multi-anomaly task detection model. It uses pretrained transformers' variant to encode a log sequences and adapters to learn a log structure and anomaly types. Adapter-based approach collects contextual information, eliminates information loss in learning, and learns anomaly detection tasks from different log sources without overuse of parameters. Lastly, our work elucidates the decision making process of the proposed model on different log datasets to emphasize extraction of threat data via explainability experiments.

show abstract

Section: Background and Related Workmentioning

confidence: 99%

Section: Background and Related Workmentioning

confidence: 99%

Section: Background and Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

AnomalyAdapters: Parameter-Efficient Multi-Anomaly Task Detection

Ünal

Dağ

2022

IEEE Access

View full text Add to dashboard Cite

show abstract

Log‐based anomaly detection for distributed systems: State of the art, industry experience, and open issues

Wei,

Wang,

Sun

et al. 2024

J Software Evolu Process

View full text Add to dashboard Cite

Distributed systems have been widely used in many safety‐critical areas. Any abnormalities (e.g., service interruption or service quality degradation) could lead to application crashes or decrease user satisfaction. These things may cause serious economic losses. Among the various quality assurance approaches for distributed systems, log‐based anomaly detection (LAD) has become a popular research topic. Its popularity relates to system logs being able to record and reveal important run‐time information. This paper presents a general LAD framework for distributed systems. Log grouping and feature‐pattern mining are two crucial LAD components that impact on the anomaly‐detection effectiveness. We also present a systematic survey of techniques in these two directions; propose classification frameworks for log grouping and feature patterns; and summarize four log‐grouping techniques and five feature patterns (which refer to invariant relationships among logs that can be used for anomaly detection). To evaluate their applicability, we report on the findings when applying existing techniques to Ray, a popular industrial distributed system. Based on these findings, several open issues are identified, which provide potential guidance for future research and development.

show abstract

Generation of Regression Tests From Logs With Clustering Guided by Usage Patterns

Tamagnan,

Vernotte,

Bouquet

et al. 2024

Software Testing Verif & Rel

View full text Add to dashboard Cite

Clustering is increasingly being used to select the appropriate test suites. In this paper, we apply this approach to regression testing. Regression testing is the practice of verifying the robustness and reliability of software by retesting after changes have been made. Creating and maintaining functional regression tests is a laborious and costly activity. To be effective, these tests must represent the actual user journeys of the application. In addition, an optimal number of test cases is critical for the rapid execution of the regression test suite to stay within the time and computational resource budget as it is re‐run at each major iteration of the software development. Therefore, the selection and maintenance of functional regression tests based on the analysis of application logs has gained popularity in recent years. This paper presents a novel approach to improve regression testing by automating the creation of test suites using user traces fed into clustering pipelines. Our methodology introduces a new metric based on pattern mining to quantify the statistical coverage of prevalent user paths. This metric helps to determine the optimal number of clusters within a clustering pipeline, thus addressing the challenge of suboptimal test suite sizes. Additionally, we introduce two criteria, to systematically evaluate and rank clustering pipelines. Experimentation involving 33 variations of clustering pipelines across four datasets demonstrates the potential effectiveness of our automated approach compared with manually crafted test suites. (All the experiments and data on Scanner, Spree and Booked Scheduler are available at https://github.com/frederictamagnan/STVR2024.) Then, we analyse the semantics of the clusters based on their principal composing patterns.

show abstract

Self-Attentive Classification-Based Anomaly Detection in Unstructured Logs

Cited by 86 publications

References 15 publications

AnomalyAdapters: Parameter-Efficient Multi-Anomaly Task Detection

AnomalyAdapters: Parameter-Efficient Multi-Anomaly Task Detection

Log‐based anomaly detection for distributed systems: State of the art, industry experience, and open issues

Generation of Regression Tests From Logs With Clustering Guided by Usage Patterns

Contact Info

Product

Resources

About