A Semantic-aware Representation Framework for Online Log Analysis

Meng, Weibin; Liu, Ying; Huang, Yuheng; Zhang, Shenglin; Zaiter, Federico; Chen, B. J.; Pei, Dan

doi:10.1109/icccn49398.2020.9209707

Cited by 45 publications

(28 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Following the previous work [47], [12], we apply a sliding window with a length of 20 messages and a step size of 1 message to construct log sequences. We compare the results of NeuralLog and five existing approaches, including Support Vector Machine-based approach (SVM) [6], Logistic Regression-based approach (LR) [10], Invariant Mining (IM) [11], LogRobust [8], and Log2Vec [48]. Traditional approaches, such as SVM, LR, and IM, transform the log sequences into log count vectors, then build unsupervised or supervised machine learning models to detect anomalies.…”

Section: B Rq1: How Effective Is Neurallog?mentioning

confidence: 99%

“…LogRobust then leverages an Attention-based Bi-LSTM to learn and detect anomalies. Log2Vec [48] accurately extracts the semantic and syntax information from log messages and leverages the Deeplog [5] model to improve the accuracy of anomaly detection. We do not compare with DeepLog [5] because previous studies already showed that Log2Vec outperforms DeepLog [48].…”

Section: B Rq1: How Effective Is Neurallog?mentioning

confidence: 99%

“…Log2Vec [48] accurately extracts the semantic and syntax information from log messages and leverages the Deeplog [5] model to improve the accuracy of anomaly detection. We do not compare with DeepLog [5] because previous studies already showed that Log2Vec outperforms DeepLog [48]. Note that there are some other recent state-of-the-art methods such as LogAnomaly [12].…”

Section: B Rq1: How Effective Is Neurallog?mentioning

confidence: 99%

“…As aforementioned in Section III-C, the Drain parser could inaccurately parse a noticeable number of log messages on BGL and Thunderbird datasets. Log2Vec [48] transforms raw log messages into semantic vectors, thus can avoid errors from log parsers. Besides, Log2Vec also adopts MIMICK [49], an approach of inducing word embedding from character-level features to handle OOV words to improve anomaly detection performance.…”

Section: B Rq1: How Effective Is Neurallog?mentioning

confidence: 99%

“…We apply the default parameters and settings (e.g., sliding window size, step size, etc.) used in the previous work [28], [48], [8]. Still, the correctness of these implementations could be a threat.…”

Section: B Threats To Validitymentioning

confidence: 99%

See 4 more Smart Citations

Log-based Anomaly Detection Without Log Parsing

Zhang

2021

Preprint

View full text Add to dashboard Cite

Software systems often record important runtime information in system logs for troubleshooting purposes. There have been many studies that use log data to construct machine learning models for detecting system anomalies. Through our empirical study, we find that existing log-based anomaly detection approaches are significantly affected by log parsing errors that are introduced by 1) OOV (out-of-vocabulary) words, and 2) semantic misunderstandings. The log parsing errors could cause the loss of important information for anomaly detection. To address the limitations of existing methods, we propose NeuralLog, a novel log-based anomaly detection approach that does not require log parsing. NeuralLog extracts the semantic meaning of raw log messages and represents them as semantic vectors. These representation vectors are then used to detect anomalies through a Transformer-based classification model, which can capture the contextual information from log sequences. Our experimental results show that the proposed approach can effectively understand the semantic meaning of log messages and achieve accurate anomaly detection results. Overall, NeuralLog achieves F1-scores greater than 0.95 on four public datasets, outperforming the existing approaches.

show abstract