Software Log Anomaly Detection Through One Class Clustering of Transformer Encoder Representation

Deep Learning for Anomaly Detection in Log Data: A Survey

“…Outliers (OUT) are single log events that do not fit to the overall structure of the data set. Most commonly, outlier events are detected based on their unusual parameter values [43], token sequences [60], [64], or occurrence times [27]. Comparatively few approaches consider outliers since the majority of reviewed approaches focus on collective anomalies, in particular, involving sequences of events.…”

“…Regardless of how the positive and negative samples are counted, almost all authors eventually evaluate their approaches using the well-known metrics precision (P = T P T P +F P ), recall or true positive rate (R = T P R = T P T P +F N ), false positive rate (F P R = F P F P +T N ) and F1-score (F 1 = 2•P •R P +R ). Less common evaluation metrics are the accuracy (ACC = T P +T N T P +T N +F P +F N ) used in 15 publications as well as the area under curve which is computed for precisionrecall-curves [31] and receiver operator characteristic (ROC) curves [43], [60]. Other metrics that are more specific to deep learning applications are the number of model parameters [38], [61] and time to train models or run the detection (ER-3) [29], [32], [37], [47], [52], [68].…”