一句话：提出不精确标注策略与MIDLog，用多示例学习从粗粒度日志集合中分离异常日志，实现弱监督日志异常检测。
日志异常检测对保障软件可用性至关重要，但现有方法依赖日志条目的细粒度精确标签，而真实系统中难以获得。针对该问题，论文提出不精确标注策略：专家无需标注单条日志，只需标注一个时间跨度内的日志集合。基于此，论文提出MIDLog，一种带不精确标签的弱监督日志异常检测方法，利用多示例学习范式从被标注为异常的日志集合中显式分离异常日志条目，从而从粗粒度标签推导出日志条目的精确异常标签。在三个公开数据集上的大量实验表明，使用不精确标签时F1分数超过85%。
Log-based anomaly detection is essential for maintaining software availability. However, existing log-based anomaly detection approaches heavily rely on fine-grained exact labels of log entries which are very hard to obtain in real-world systems. This brings a key problem that anomaly detection models require supervision signals while labeled log entries are unavailable. Facing this problem, we propose a new labeling strategy called inexact labeling that instead of labeling an log entry, system experts can label a bag of log entries in a time span. Furthermore, we propose MIDLog, a weakly supervised log-based anomaly detection approach with inexact labels. We leverage the multiinstance learning paradigm to achieve explicit separation of anomalous log entries from the inexact labeled anomalous log set so as to deduce exact anomalous log labels from inexact labeled log sets. Extensive evaluation on three public datasets shows that our approach achieves an F1 score of over 85% with inexact labels.
DOI 原文 ·
@inproceedings{paperbot8866,
title = {Weakly-Supervised Log-Based Anomaly Detection with Inexact Labels via Multi-Instance Learning},
author = {Minghua He and Tong Jia and Chiming Duan and Huaqian Cai and Ying Li and Gang Huang},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00189}
}