用GPT+焦点损失，提升系统日志异常检测精度
A Novel GPT-Based Framework for Anomaly Detection in System Logs
- 将日志转为事件ID序列，结合焦点损失缓解类别不平衡
- 优化后GPT-2在精确率、召回率、F1上显著优于原模型
- 性能媲美甚至超过GPT-3.5 API，适合安全监控场景
系统日志中的异常事件识别是网络安全防御的关键环节。然而，该过程面临数据量大、异常分布稀疏及传统方法精度不足等挑战。本文提出一种基于生成式预训练变换器（GPT）的智能日志异常检测方法。首先使用Drain解析器将原始日志转换为事件ID序列，再引入焦点损失（Focal Loss）解决类别不平衡问题。实验表明，优化后的GPT-2模型在精确率、召回率和F1分数等多项指标上均显著优于未优化模型，且在具体任务中表现可比或超越GPT-3.5 API，验证了该方法的有效性与实用性。
原文摘要 · Abstract (English)
Identification of anomalous events within system logs constitutes a pivotal element within the frame- work of cybersecurity defense strategies. However, this process faces numerous challenges, including the management of substantial data volumes, the distribution of anomalies, and the precision of con- ventional methods. To address this issue, the present paper puts forward a proposal for an intelligent detection method for system logs based on Genera- tive Pre-trained Transformers (GPT). The efficacy of this approach is attributable to a combination of structured input design and a Focal Loss op- timization strategy, which collectively result in a substantial enhancement of the performance of log anomaly detection. The initial approach involves the conversion of raw logs into event ID sequences through the use of the Drain parser. Subsequently, the Focal Loss loss function is employed to address the issue of class imbalance. The experimental re- sults demonstrate that the optimized GPT-2 model significantly outperforms the unoptimized model in a range of key metrics, including precision, recall, and F1 score. In specific tasks, comparable or superior performance has been demonstrated to that of the GPT-3.5 API.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。