用LLaMA2模型生成日志并识别异常，效果优于现有方法。
LogLLaMA: Transformer-based log anomaly detection with LLaMA
- 基于LLaMA2微调生成正常日志序列，学习模式规律。
- 通过强化学习训练模型区分异常日志，在三数据集上表现最优。
- 适合需要高精度日志监控的运维与安全团队使用。
日志异常检测旨在区分异常日志与正常日志。基于Transformer的大语言模型（LLM）因其强大的复杂长文本模式理解能力，正被广泛应用于日志异常检测。本文提出LogLLaMA，一个利用LLaMA2的新框架。首先在BGL、Thunderbird和HDFS三个大规模数据集的正常日志上进行微调，使模型能根据前序日志生成后续日志。随后，通过强化学习进一步训练该生成模型，以识别异常日志。实验结果表明，LogLLaMA在BGL、Thunderbird和HDFS数据集上的异常检测性能均超越当前最先进方法。
原文摘要 · Abstract (English)
Log anomaly detection refers to the task that distinguishes the anomalous log messages from normal log messages. Transformer-based large language models (LLMs) are becoming popular for log anomaly detection because of their superb ability to understand complex and long language patterns. In this paper, we propose LogLLaMA, a novel framework that leverages LLaMA2. LogLLaMA is first finetuned on normal log messages from three large-scale datasets to learn their patterns. After finetuning, the model is capable of generating successive log messages given previous log messages. Our generative model is further trained to identify anomalous log messages using reinforcement learning (RL). The experimental results show that LogLLaMA outperforms the state-of-the-art approaches for anomaly detection on BGL, Thunderbird, and HDFS datasets.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。