A2Log: Attentive Augmented Log Anomaly Detection

Wittkopp, Thorsten; Acker, Alexander; Nedelkoski, Sasho; Bogatinovski, Jasmin; Scheinert, Dominik; Wu, Feng; Kao, Odej

doi:10.24251/hicss.2022.234

Cited by 14 publications

(7 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The goal is to identify which kinds of anomalies are easy or hard to predict and also which methods perform well on which anomalies. In particular, we chose two deep learning approaches Deeplog [5] and A2Log [22], and three data mining approaches PCA [10], Invarant Miners [14], and Isolation Forest [13]. We evaluated all methods on four different train/test splits of 0.2/0.…”

Section: Evaluation Of Unsupervised Learning Methodsmentioning

confidence: 99%

“…It uses templates [8], performs anomaly detection per log message, and constructs system execution workflow models for diagnosis purposes. A2Log [22] utilizes a self-attention neural network to obtain anomaly scores for log messages and then performs anomaly detection via a decision boundary that was set based on data augmentation of available normal training data.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

A Taxonomy of Anomalies in Log Data

Wittkopp¹,

Wiesner²,

Scheinert³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Log data anomaly detection is a core component in the area of artificial intelligence for IT operations. However, the large amount of existing methods makes it hard to choose the right approach for a specific system. A better understanding of different kinds of anomalies, and which algorithms are suitable for detecting them, would support researchers and IT operators. Although a common taxonomy for anomalies already exists, it has not yet been applied specifically to log data, pointing out the characteristics and peculiarities in this domain.In this paper, we present a taxonomy for different kinds of log data anomalies and introduce a method for analyzing such anomalies in labeled datasets. We applied our taxonomy to the three common benchmark datasets Thunderbird, Spirit, and BGL, and trained five stateof-the-art unsupervised anomaly detection algorithms to evaluate their performance in detecting different kinds of anomalies. Our results show, that the most common anomaly type is also the easiest to predict. Moreover, deep learning-based approaches outperform data mining-based approaches in all anomaly types, but especially when it comes to detecting contextual anomalies.

show abstract

Section: Evaluation Of Unsupervised Learning Methodsmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

A Taxonomy of Anomalies in Log Data

Wittkopp¹,

Wiesner²,

Scheinert³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…Another way to classify anomaly detection is to divide it into supervised and unsupervised learning. To solve the issue of lack of labeled log data, some unsupervised log anomaly detection methods [19][20][21] have been proposed, which have two significant steps: anomaly scoring and anomaly decision. However, unsupervised learning methods do not make full use of labeling features, and the algorithms do not know the exact output in advance, so the effectiveness is doubtful.…”

Section: Related Workmentioning

confidence: 99%

Log Anomaly Detection Based on Hierarchical Graph Neural Network and Label Contrastive Coding

Fang¹,

Zhao²,

Xu³

et al. 2023

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

System logs are essential for detecting anomalies, querying faults, and tracing attacks. Because of the time-consuming and labor-intensive nature of manual system troubleshooting and anomaly detection, it cannot meet the actual needs. The implementation of automated log anomaly detection is a topic that demands urgent research. However, the prior work on processing log data is mainly one-dimensional and cannot profoundly learn the complex associations in log data. Meanwhile, there is a lack of attention to the utilization of log labels and usually relies on a large number of labels for detection. This paper proposes a novel and practical detection model named LCC-HGLog, the core of which is the conversion of log anomaly detection into a graph classification problem. Semantic temporal graphs (STG) are constructed by extracting the raw logs' execution sequences and template semantics. Then a unique graph classifier is used to better comprehend each STG's semantic, sequential, and structural features. The classification model is trained jointly by graph classification loss and label contrastive loss. While achieving discriminability at the class-level, it increases the fine-grained identification at the instance-level, thus achieving detection performance even with a small amount of labeled data. We have conducted numerous experiments on real log datasets, showing that the proposed model outperforms the baseline methods and obtains the best all-around performance. Moreover, the detection performance degrades to less than 1% when only 10% of the labeled data is used. With 200 labeled samples, we can achieve the same or better detection results than the baseline methods.

show abstract

“…The LAMA model is applied for anomaly detection, where our model is applied for failure prediction. [77] also employed the transformer-encoder architecture to develop an unsupervised anomaly detection technique called A2Log. There are other recent research studies that utilized the self-attention with different transformer variants for error and anomaly detection such as LAnoBERT [49], LogAttention [25], and [48].…”

Section: Related Workmentioning

confidence: 99%

Clairvoyant

Alharthi

Jhumka

et al. 2022

Proceedings of the 36th ACM International Conference on Supercomputing

View full text Add to dashboard Cite

System failures are expected to be frequent in the exascale era such as current Petascale systems. The health of such systems is usually determined from challenging analysis of large amounts of unstructured & redundant log data. In this paper, we leverage log data and propose Clairvoyant, a novel self-supervised (i.e., no labels needed) model to predict node failures in HPC systems based on a recent deep learning approach called transformer-decoder and the self-attention mechanism. Clairvoyant predicts node failures by (i) predicting a sequence of log events and then (ii) identifying if a failure is a part of that sequence. We carefully evaluate Clairvoyant and another state-of-the-art failure prediction approach -Desh, based on two real-world system log datasets. Experiments show that Clairvoyant is significantly better: e.g., it can predict node failures with an average Bleu, Rouge, and MCC scores of 0.90, 0.78, and 0.65 respectively while Desh scores only 0.58, 0.58, and 0.25. More importantly, this improvement is achieved with faster training and prediction time, with Clairvoyant being about 25× and 15× faster than Desh respectively.

show abstract

A2Log: Attentive Augmented Log Anomaly Detection

Cited by 14 publications

References 27 publications

A Taxonomy of Anomalies in Log Data

A Taxonomy of Anomalies in Log Data

Log Anomaly Detection Based on Hierarchical Graph Neural Network and Label Contrastive Coding

Clairvoyant

Contact Info

Product

Resources

About