一句话：提出首个自动化日志生成方法，无需运行系统即可用程序分析合成运行时日志序列，为异常检测提供高质量训练数据。
现有公开日志数据集在日志事件完备性、跨系统可扩展性与用途灵活性上存在不足，制约了基于日志的异常检测的工业应用。AutoLog 是首个自动化日志生成方法：无需实际运行系统，先用程序分析探测与调用图关联的日志语句，再为每个方法构建执行图并剪枝调用图，以可扩展方式定位日志相关执行路径，最后依据人工知识为路径传播异常标签，并通过可控参数生成灵活日志序列。在 50 个流行 Java 项目上，其日志事件比同系统现有数据集多 9–58 倍，单机生成速度快 15 倍，且可调节数据规模、异常率与组件指示符；使用其数据使异常检测器性能提升约 1.93%。
The rapid progress of modern computing systems has led to a growing interest in informative run-time logs. Various log-based anomaly detection techniques have been proposed to ensure software reliability. However, their implementation in the industry has been limited due to the lack of high-quality public log resources as training datasets. While some log datasets are available for anomaly detection, they suffer from limitations in (1) comprehensiveness of log events; (2) scalability over diverse systems; and (3) flexibility of log utility. To address these limitations, we propose AUTOLOG, the first automated log generation methodology for anomaly detection. AUTOLOG uses program analysis to generate runtime log sequences without actually running the system. AUTOLOG starts with probing comprehensive logging statements associated with the call graphs of an application. Then, it constructs execution graphs for each method after pruning the call graphs to find log-related execution paths in a scalable manner. Finally, AUTOLOG propagates the anomaly label to each acquired execution path based on human knowledge. It generates flexible log sequences by walking along the log execution paths with controllable parameters. Experiments on 50 popular Java projects show that AUTOLOG acquires significantly more (9x-58x) log events than existing log datasets from the same system, and generates log messages much faster (15x) with a single machine than existing passive data collection approaches. AUTOLOG also provides hyper-parameters to adjust the data size, anomaly rate, and component indicator for simulating different real-world scenarios. We further demonstrate AUTOLOG's practicality by showing that AUTOLOG enables log-based anomaly detectors to achieve better performance (1.93%) compared to existing log datasets. We hope AUTOLOG can facilitate the benchmarking and adoption of automated log analysis techniques.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{abs-2308-09324,
title = {AutoLog: A Log Sequence Synthesis Framework for Anomaly Detection},
author = {Yintong Huo and Yichen Li and Yuxin Su and Pinjia He and Zifan Xie and Michael R. Lyu},
booktitle = {ASE},
year = {2023},
doi = {10.1109/ase56229.2023.00133}
}