一句话：将日志异常检测建模为语义相似度问题，用预训练语言模型监督编码器，无需模板提取即可检测异常。
软件日志是发现系统行为偏离的重要依据，但自动检测日志异常面临数据量大、半结构化、格式不统一以及日志记录随时间演化等挑战。本文提出 SemantiLog，将日志异常检测视为语义相似度问题：先用通用预训练语言模型生成日志序列之间的成对相似度分数，并借助真实二值标签对其进行增强，再以这些相似度标签监督训练一个面向语义相似度的编码器。推理阶段，模型计算待查询序列的编码与正常样本平均编码之间的余弦相似度，据此判定异常。该方法无需模板提取，也不依赖固定词表，在多个基准上优于现有技术，并且在仅提供少量异常样本时仍能取得有竞争力的性能。
Logs produced by software applications are invaluable for spotting deviations from expected system behavior. However, automatically detecting anomalies from log data is challenging due to the volume, semi-structured nature, lack of standard formatting, and potential evolution of log records over time. In this work, we approach log-based anomaly detection as a semantic similarity problem. We generate pairwise similarity scores using a general-purpose pre-trained language model and further augment them with ground-truth binary labels. The generated similarity labels supervise an encoder trained for semantic similarity. At inference time, anomalies are detected based on the cosine similarity between the encoded query sequence and the average normal encoding. Our method outperforms contemporary techniques on multiple benchmarks without template extraction or a fixed vocabulary and achieves competitive performance even when provided with limited abnormal examples.
DOI 原文 ·
@inproceedings{paperbot8362,
title = {SemantiLog: Log-based Anomaly Detection with Semantic Similarity},
author = {Yoli Shavit and Kathy Razmadze and Gary Mataev and Hanan Shteingart and Eitan Zahavi and Zachi Binshtock},
booktitle = {ASE},
year = {2024},
doi = {10.1145/3691620.3695317}
}