一句话：提出半监督日志异常检测器 LogOnline，引入在线学习持续学习正常日志序列模式，无需人工标注且对日志不稳定鲁棒。
现代云系统产生大量日志，但现有基于日志的异常检测方法在实际应用中仍面临两大问题：有监督方法依赖大量人工标注日志，且系统日志不稳定、新日志事件不断出现会导致模型性能退化。为此，论文提出 LogOnline，一种半监督异常检测器，并引入在线学习机制，使其能够在新日志序列出现时持续学习正常序列模式，无需标注数据或人工干预，从而缓解日志不稳定问题。作者在两个常用公开数据集上评估 LogOnline。实验表明，其效果与所比较的有监督方法相当，并优于所有半监督对比方法；当日志不稳定问题更普遍时，LogOnline 取得最佳性能，验证了其实用性。
Logs are prevalent in modern cloud systems and serve as a valuable source of information for system maintenance. Over the years, a lot of research and industrial efforts have been devoted to the field of log-based anomaly detection. Through analyzing the limitations of existing approaches, we find that most of them still suffer from practical issues and are thus hard to be applied in real-world scenarios. For example, supervised approaches are dependent on a large amount of labeled log data for training, which can require much manual labeling effort. Besides, log instability, which is a pervasive issue in real-world systems, poses great challenge to existing methods, especially under the presence of many dissimilar new log events. To overcome these problems, we propose LogOnline, which is a semi supervised anomaly detector aided with online learning mechanism. The semi-supervised nature of LogOnline makes it able to get rid of the erroneous and time-consuming manual labeling of log data. Based on our proposed online learning mechanism, LogOnline can learn the normal sequence patterns continuously as new log sequences emerge, thus staying robust to unstable log data. Unlike previous works, the proposed online learning mechanism requires no labeled log data nor human intervention in the process. We have evaluated LogOnline on two widely used public datasets, and the experimental results demonstrate the effectiveness of LogOnline. In particular, LogOnline achieves a comparable result with the studied supervised approaches, outperforming all semi-supervised counterparts. When the log instability issue is more common, LogOnline exhibits the best performance over all compared approaches, further confirming its practicability.
@inproceedings{WangSZTGL23,
title = {LogOnline: A Semi-Supervised Log-Based Anomaly Detector Aided with Online Learning Mechanism},
author = {Xuheng Wang and Jiaxing Song and Xu Zhang and Junshu Tang and Weihe Gao and Qingwei Lin},
booktitle = {ASE},
year = {2023},
doi = {10.1109/ase56229.2023.00043}
}