arXiv:2601.14336cs.LG2026-01

用元学习+原型网络实现跨日志域的异常检测,提升泛化能力。

Log anomaly detection via Meta Learning and Prototypical Networks for Cross domain generalization

  • 结合解析与动态标注,迁移源域异常知识到目标域。
  • 在HDFS和Linux数据集上平均F1达0.91,优于现有方法。
  • 适合需要跨系统部署的日志监控场景,尤其小样本异常场景。

日志异常检测对系统可靠性至关重要,但受类别不平衡影响极大。此外,某一领域训练的模型难以适用于其他领域(如HDFS与Linux),需跨域适应。传统模型因数据漂移及目标域缺乏标注异常而泛化失败。为此,本文提出一种基于元学习的端到端框架:先通过Drain3日志解析与基于语义和模糊匹配的动态标注技术,迁移源域异常知识;再利用BERT获取语义嵌入并进行特征选择降维;随后采用模型无关元学习(MAML)与原型网络快速适应;最后使用SMOTE处理数据不平衡。所有结果均基于留一法源域验证,报告平均F1得分。实验表明,该方法在跨域设置下取得最高平均F1(0.91),验证了其有效性。

原文摘要 · Abstract (English)

Log anomaly detection is essential for system reliability, but it is extremely challenging to do considering it involves class imbalance. Additionally, the models trained in one domain are not applicable to other domains, necessitating the need for cross-domain adaptation (such as HDFS and Linux). Traditional detection models often fail to generalize due to significant data drift and the inherent absence of labeled anomalies in new target domains. To handle the above challenges, we proposed a new end-to-end framework based on a meta-learning approach. Our methodology first gets the data ready by combining a Drain3 log parsing mechanism with a dynamic drift-based labeling technique that uses semantic and fuzzy matching to move existing anomaly knowledge from one source to another. BERT-based semantic embeddings are obtained, and the feature selection is invoked to reduce the dimensionality. Later, Model Agnostic Meta-Learning (MAML) and Prototypical Networks models are trained to adapt quickly and effectively. The SMOTE oversampling method is employed to handle imbalances in the data. All the results are obtained by employing the leave-one-out source method, and the corresponding mean F1 scores are reported. Our empirical findings validate that the proposed meta-learning-driven approach yielded the highest mean F1 score and proved to be effective for cross-domain settings.

日志异常检测元学习跨域泛化

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。