直接在压缩日志流上检测异常，省去解压解析开销
CLAD: Efficient Log Anomaly Detection Directly on Compressed Representations
- 设计专用架构，从压缩字节流中提取多尺度异常特征
- 平均F1达0.9909，在5个数据集上领先基线2.72个百分点
- 适合需要实时处理海量压缩日志的系统监控场景
系统日志的爆炸式增长使得流式压缩成为必要，但现有日志异常检测（LAD）方法需完整解压和解析，导致严重预处理开销。我们提出CLAD，首个直接在压缩字节流上进行深度学习日志异常检测的框架。其核心洞察是：正常日志压缩后呈现规律字节模式，而异常会系统性破坏这些模式。为从密文字节中提取多尺度偏离特征，我们设计了融合空洞卷积字节编码器、混合Transformer-mLSTM与四路聚合池化的专用架构，并采用掩码预训练+焦点对比微调的两阶段训练策略，有效应对严重类别不平衡问题。在五个数据集上的评估显示，CLAD达到0.9909的平均F1-score，优于最佳基线2.72个百分点。该方法在完全消除解压与解析开销的同时保持卓越准确性，对结构化流式压缩器具有良好的泛化能力。
原文摘要 · Abstract (English)
The explosive growth of system logs makes streaming compression essential, yet existing log anomaly detection (LAD) methods incur severe pre-processing overhead by requiring full decompression and parsing. We introduce CLAD, the first deep learning framework to perform LAD directly on compressed byte streams. CLAD bypasses these bottlenecks by exploiting a key insight: normal logs compress into regular byte patterns, while anomalies systematically disrupt them. To extract these multi-scale deviations from opaque bytes, we propose a purpose-built architecture integrating a dilated convolutional byte encoder, a hybrid Transformer--mLSTM, and four-way aggregation pooling. This is coupled with a two-stage training strategy of masked pre-training and focal-contrastive fine-tuning to effectively handle severe class imbalance. Evaluated across five datasets, CLAD achieves a state-of-the-art average F1-score of 0.9909 and outperforms the best baseline by 2.72 percentage points. It delivers superior accuracy while completely eliminating decompression and parsing overheads, offering a robust solution that generalizes to structured streaming compressors.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。