一句话:系统再评估五种深度学习日志异常检测模型,发现评测中的数据因素显著影响结果,该问题远未解决。
软件密集型系统会为排障而生成日志,近年许多工作用深度学习模型从日志中自动检测系统异常,并常报告极高精度(如在常用 HDFS 数据集上 F-measure 普遍大于 0.9)。为弄清该问题究竟被解决到何种程度,本文对五种当前最优的深度学习日志异常检测模型在四个公开日志数据集上进行了深入分析。实验围绕模型评测的多个方面展开,包括训练数据选择、数据分组、类别分布、数据噪声以及早期检测能力。结果显示,这些方面均对评测结果有显著影响,且所研究的模型并不总是表现良好,说明基于日志的异常检测问题尚未解决。作者据此指出既有评测的不足,并为未来工作提出建议。
Software-intensive systems produce logs for troubleshooting pur-poses. Recently, many deep learning models have been proposed to automatically detect system anomalies based on log data. These models typically claim very high detection accuracy. For example, most models report an F-measure greater than 0.9 on the commonly-used HDFS dataset. To achieve a profound understanding of how far we are from solving the problem of log-based anomaly detection, in this paper, we conduct an in-depth analysis of five state-of-the-art deep learning-based models for detecting system anomalies on four public log datasets. Our experiments focus on several aspects of model evaluation, including training data selection, data grouping, class distribution, data noise, and early detection ability. Our re-sults point out that all these aspects have significant impact on the evaluation, and that all the studied models do not always work well. The problem of log-based anomaly detection has not been solved yet. Based on our findings, we also suggest possible future work.