一句话：提出 LogAction，结合迁移学习与主动学习，仅用 2% 人工标注即实现跨系统日志异常检测，F1 达 93.01%。
基于日志的异常检测对保障软件系统可靠性与性能至关重要，但现有方法依赖大量人工标注，而跨系统场景下源域与目标域数据分布差异及冷启动问题又限制了迁移学习与主动学习的效果。本文提出 LogAction，一种基于主动域适应的日志异常检测模型。它一方面利用成熟系统的标注数据训练基模型以缓解冷启动，另一方面通过自由能采样与不确定性采样，挑选位于分布边界的日志进行人工标注，从而以极少标注代价弥合跨系统分布差距。在六组不同数据集组合上，LogAction 仅使用 2% 人工标签即取得平均 93.01% 的 F1 值，较部分先进方法提升 26.28%。
Log-based anomaly detection is a essential task for ensuring the reliability and performance of software systems. However, the performance of existing anomaly detection methods heavily relies on labeling, while labeling a large volume of logs is highly challenging. To address this issue, many approaches based on transfer learning and active learning have been proposed. Nevertheless, their effectiveness is hindered by issues such as the gap between source and target system data distributions and cold-start problems. In this paper, we propose LogAction, a novel log-based anomaly detection model based on active domain adaptation. LogAction integrates transfer learning and active learning techniques. On one hand, it uses labeled data from a mature system to train a base model, mitigating the cold-start issue in active learning. On the other hand, LogAction utilize free energy-based sampling and uncertainty-based sampling to select logs located at the distribution boundaries for manual labeling, thus addresses the data distribution gap in transfer learning with minimal human labeling efforts. Experimental results on six different combinations of datasets demonstrate that LogAction achieves an average 93.01% F1 score with only 2% of manual labels, outperforming some state-of-the-art methods by 26.28%. Website: https://logaction.github.io
DOI 原文 ·
@inproceedings{paperbot9294,
title = {LogAction: Consistent Cross-system Anomaly Detection through Logs via Active Domain Adaptation},
author = {Chiming Duan and Minghua He and Pei Xiao and Tong Jia and Xin Zhang and Zhewei Zhong and Xiang Luo and Yan Niu and Lingzhe Zhang and Siyu Yu and Yifan Wu and Weijie Hong and Ying Li and Gang Huang},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00064}
}