用强化学习提升日志异常检测精度，实时性好且准确率高。
LogNEO: A GPT-Neo Reinforcement Learning Framework for Accurate Real-Time Log Anomaly Detection
- 基于GPT-Neo的强化学习框架，设计位置感知奖励机制。
- 在三个基准上F1最高达0.984，召回率比前人高6个百分点。
- 适合需要高实时性与高准确性的生产系统日志监控场景。
大规模系统日志异常检测对现代计算基础设施的可靠性与安全性至关重要。本文提出LogNEO，一个基于EleutherAI的GPT-Neo（1.3B参数）的日志异常检测器，通过新颖的局部奖励、指数衰减的位置感知奖励策略，并结合熵正则化与近端策略优化（PPO）进行微调。该位置感知奖励显式建模预测难度：早期位置对正确预测给予更高奖励，后期错误则面临更强惩罚。LogNEO在HDFS、BGL和Thunderbird基准上分别取得0.927、0.913和0.984的F1分数，召回率相比先前最优方法LogGPT最高提升6个百分点，同时保持相当的精确率。在Apache Kafka、Redis及TensorRT加速推理的生产级微服务部署中，实现每秒15,000事件处理下的45毫秒端到端延迟。
原文摘要 · Abstract (English)
Detecting anomalies in large-scale system logs is critical for the reliability and security of modern computing infrastructure. We present LogNEO, a log anomaly detector built on EleutherAI's GPT-Neo (1.3B parameters) and fine-tuned with a novel partial-credit, exponentially decaying position-aware reward scheme combined with cross-entropy regularisation via Proximal Policy Optimisation (PPO). The position-aware reward explicitly models prediction difficulty: early positions receive higher rewards for correct predictions, while later positions incur stronger penalties for errors. LogNEO attains F1-scores of 0.927, 0.913, and 0.984 on the HDFS, BGL, and Thunderbird benchmarks, improving recall by up to 6 percentage points over the prior state-of-the-art LogGPT while maintaining comparable precision. A production microservice deployment over Apache Kafka, Redis, and TensorRT-accelerated inference demonstrates 45 ms end-to-end latency at 15,000 events per second.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。