ContraLog：基于对比学习和掩码语言模型的日志文件异常检测
ContraLog: Log File Anomaly Detection with Contrastive Learning and Masked Language Modeling
AI总结：
ContraLog通过对比学习和掩码语言模型实现日志文件异常检测，无需解析器即可预测连续消息嵌入，有效应对复杂日志数据。
摘要：
日志文件记录了计算事件，反映了系统状态和行为，使其成为现代计算机系统操作洞察的主要来源。自动化日志异常检测因此至关重要，但大多数现有方法依赖于日志解析器，将消息压缩成离散模板，丢弃变量值和语义内容。我们提出ContraLog，一种无需解析器的自监督方法，将日志异常检测重新定义为预测连续消息嵌入，而不是离散模板ID。ContraLog结合了生成丰富嵌入的单个日志消息编码器和序列编码器，以建模序列内的时间依赖性。模型通过结合掩码语言模型和对比学习进行训练，以根据上下文预测掩码消息嵌入。在HDFS、BGL和Thunderbird基准数据集上的实验结果表明，该方法在具有多样化日志消息的复杂数据集上有效。此外，我们发现由ContraLog生成的消息嵌入携带有意义的信息，并且即使没有序列上下文也能预测异常。这些结果突显了嵌入层面的预测作为日志异常检测的方法，具有应用于其他事件序列的潜在应用。
英文摘要：
Log files record computational events that reflect system state and behavior, making them a primary source of operational insights in modern computer systems. Automated anomaly detection on logs is therefore critical, yet most established methods rely on log parsers that collapse messages into discrete templates, discarding variable values and semantic content. We propose ContraLog, a parser-free and self-supervised method that reframes log anomaly detection as predicting continuous message embeddings rather than discrete template IDs. ContraLog combines a message encoder that produces rich embeddings for individual log messages with a sequence encoder to model temporal dependencies within sequences. The model is trained with a combination of masked language modeling and contrastive learning to predict masked message embeddings based on the surrounding context. Experiments on the HDFS, BGL, and Thunderbird benchmark datasets empirically demonstrate effectiveness on complex datasets with diverse log messages. Additionally, we find that message embeddings generated by ContraLog carry meaningful information and are predictive of anomalies even without sequence context. These results highlight embedding-level prediction as an approach for log anomaly detection, with potential applicability to other event sequences.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
