一句话：提出半监督日志异常检测方法PLELog，通过概率标签估计利用历史异常知识，并用注意力GRU提升检测效果。
现有基于日志的异常检测方法存在实际困难：监督方法依赖大量人工标注数据，无监督与半监督方法因未学习历史异常知识而性能不理想。本文提出半监督方法PLELog，通过概率标签估计融入历史异常知识，从而发挥监督方法的优势，同时避免耗时的人工标注；它还利用语义嵌入应对不稳定的日志数据，并设计基于注意力的GRU神经网络高效、有效地检测异常。作者在两个广泛使用的公开数据集上评估PLELog，F1分数平均提升181.6%，显著优于对比方法。此外，PLELog已应用于作者所在高校和一家大型企业的两个真实系统，进一步验证了其实用性。
With the growth of software systems, logs have become an important data to aid system maintenance. Log-based anomaly detection is one of the most important methods for such purpose, which aims to automatically detect system anomalies via log analysis. However, existing log-based anomaly detection approaches still suffer from practical issues due to either depending on a large amount of manually labeled training data (supervised approaches) or unsatisfactory performance without learning the knowledge on historical anomalies (unsupervised and semi-supervised approaches). In this paper, we propose a novel practical log-based anomaly detection approach, PLELog, which is semi-supervised to get rid of time-consuming manual labeling and incorporates the knowledge on historical anomalies via probabilistic label estimation to bring supervised approaches' superiority into play. In addition, PLELog is able to stay immune to unstable log data via semantic embedding and detect anomalies efficiently and effectively by designing an attention-based GRU neural network. We evaluated PLELog on two most widely-used public datasets, and the results demonstrate the effectiveness of PLELog, significantly outperforming the compared approaches with an average of 181.6% improvement in terms of F1-score. In particular, PLELog has been applied to two real-world systems from our university and a large corporation, further demonstrating its practicability
@inproceedings{YangCWWJDZ21,
title = {Semi-Supervised Log-Based Anomaly Detection via Probabilistic Label Estimation},
author = {Lin Yang and Junjie Chen and Zan Wang and Weijing Wang and Jiajun Jiang and Xuyuan Dong and Wenbin Zhang},
booktitle = {ICSE},
year = {2021},
doi = {10.1109/icse43902.2021.00130}
}