无需解析即可实时检测日志异常，性能远超现有方法。
$K^4$: Online Log Anomaly Detection Via Unsupervised Typicality Learning
- 用k-NN统计将日志转为四维特征，不依赖日志解析
- 在线评估下AUROC达0.995-0.999，训练<4秒，推理仅4μs
- 适合需要低延迟、高精度的日志监控系统
现有日志异常检测方法通常速度慢、依赖易错的解析，且评估协议不切实际。我们提出K⁴，一种无监督、不依赖解析器的高性能在线检测框架。K⁴通过高效的k近邻（k-NN）统计，将任意日志嵌入转换为紧凑的四维描述符（精确率、召回率、密度、覆盖率），使轻量级检测器可在无需重训练的情况下准确打分异常。采用更真实的在线评估协议，K⁴达到新的最优水平（AUROC: 0.995–0.999），显著优于基线方法，同时训练时间低于4秒，推理延迟低至4 μs。
原文摘要 · Abstract (English)
Existing Log Anomaly Detection (LogAD) methods are often slow, dependent on error-prone parsing, and use unrealistic evaluation protocols. We introduce $K^4$, an unsupervised and parser-independent framework for high-performance online detection. $K^4$ transforms arbitrary log embeddings into compact four-dimensional descriptors (Precision, Recall, Density, Coverage) using efficient k-nearest neighbor (k-NN) statistics. These descriptors enable lightweight detectors to accurately score anomalies without retraining. Using a more realistic online evaluation protocol, $K^4$ sets a new state-of-the-art (AUROC: 0.995-0.999), outperforming baselines by large margins while being orders of magnitude faster, with training under 4 seconds and inference as low as 4 $μ$s.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。