基于事件模板与关键参数的无监督日志异常检测方法
TPLogAD: Unsupervised Log Anomaly Detection Based on Event Templates and Key Parameters
- 分离模板与参数，分别用itemplate2vec和para2vec进行语义表示
- 在四个公开数据集上优于现有方法，降低误报与漏报
- 适用于复杂动态日志场景，无需标注，通用性强
日志系统是记录网络服务运行状态与事件的重要机制，日志异常检测是发现问题的有效手段。然而人工检测效率低且易出错。现有方法或仅使用事件模板索引，或对模板固定部分进行嵌入向量化，或依赖时间参数进行序列分析，难以全面捕捉日志中的特征与语义信息，导致漏报与误报。本文提出TPLogAD，一种通用的无监督日志异常检测方法，基于事件模板与关键参数进行分析。其中itemplate2vec与para2vec是两种高效易实现的日志语义表示方法，分别用于检测模板与参数异常，这是以往工作未实现的。此外，TPLogAD可有效避免日志多样性与动态性对检测的干扰。在四个公开日志数据集上的实验表明，TPLogAD性能优于现有方法。
原文摘要 · Abstract (English)
Log-system is an important mechanism for recording the runtime status and events of Web service systems, and anomaly detection in logs is an effective method of detecting problems. However, manual anomaly detection in logs is inefficient, error-prone, and unrealistic. Existing log anomaly detection methods either use the indexes of event templates, or form vectors by embedding the fixed string part of the template as a sentence, or use time parameters for sequence analysis. However, log entries often contain features and semantic information that cannot be fully represented by these methods, resulting in missed and false alarms. In this paper, we propose TPLogAD, a universal unsupervised method for analyzing unstructured logs, which performs anomaly detection based on event templates and key parameters. The itemplate2vec and para2vec included in TPLogAD are two efficient and easy-to-implement semantic representation methods for logs, detecting anomalies in event templates and parameters respectively, which has not been achieved in previous work. Additionally, TPLogAD can avoid the interference of log diversity and dynamics on anomaly detection. Our experiments on four public log datasets show that TPLogAD outperforms existing log anomaly detection methods.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。