用粗标签定位日志异常，精准找到问题源头。
Seeing the Needle in the Haystack: Towards Weakly-Supervised Log Instance Anomaly Localization via Counterfactual Perturbation
- 基于原型和反事实扰动的弱监督框架，仅需批次标签
- 在三个数据集上实现高精度异常定位，优于现有方法
- 适合缺乏细粒度标注的日志监控场景
日志异常检测对系统运维与安全至关重要。但在大规模网络系统中，日志数据量巨大，而实例级标注成本极高，导致细粒度异常定位困难。为此，我们提出LogMILP（基于原型与扰动一致性的多实例学习日志异常定位框架），仅使用批次级标签即可实现批次级异常检测与实例级异常定位。该方法通过原型引导的结构建模与反事实扰动一致性正则化，引导模型精准识别关键日志条目，提升在粗粒度监督下的定位可靠性与可解释性。在三个公开数据集上的实验表明，LogMILP在检测性能上具有竞争力，同时显著提升了实例级定位的可靠性。代码已开源：https://github.com/YUK1207/LogMILP。
原文摘要 · Abstract (English)
Log anomaly detection is a critical task for system operations and security assurance. However, in networked systems at scale, log data are generated at massive scale while instance-level annotations are prohibitively expensive, posing great difficulties to fine-grained anomaly localization. To address this challenge, we propose LogMILP (Log anomaly localization based on Multi-Instance Learning enhanced by prototypes and Perturbation), a weakly supervised framework that enables both bag-level anomaly detection and instance-level anomaly localization using only bag-level labels. Our method guides the model to pinpoint the critical log entries using prototype-guided structural modeling with counterfactual perturbation consistency regularization, thereby improving localization reliability and interpretability under coarse-grained supervision. Experimental results on three public datasets demonstrate that LogMILP achieves competitive detection performance while yielding significantly more reliable instance-level localization. Our code is open-sourced at https://github.com/YUK1207/LogMILP.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。