arXivDaily arXiv每日学术速递 周一至周五更新
北美退伍军人节(Veterans Day),12 日无更新
arXiv 2604.08028cs.SE
收藏

基于软件日志的异常检测的语义日志表示比较研究

A Comparative Study of Semantic Log Representations for Software Log-based Anomaly Detection

University of Helsinki(赫尔辛基大学);Free University of Bozen-Bolzano(博尔扎诺自由大学)

Yuqing Wang, Ying Song, Xiaozhou Li, Nana Reinikainen, Mika V. Mäntylä

AI总结:

本文比较了多种语义日志表示方法在不同深度学习模型中的表现,提出QTyBERT平衡了效果与效率,适用于CPU部署。

摘要:

近年来,深度学习方法在日志异常检测中越来越多地依赖于将日志事件文本内容转换为向量嵌入的语义日志表示方法作为输入。然而,这些方法通常作为端到端流程进行评估,而不同语义表示方法的影响尚不明确。本文在三个公开日志数据集上评估了广泛使用的语义日志表示方法,包括静态词嵌入方法(Word2Vec、GloVe、FastText)和基于BERT的上下文嵌入方法。我们发现,在CPU部署设置下存在效果与效率的权衡:BERT方法更有效,但生成日志嵌入的时间更长,限制了其实用性;静态词嵌入方法更高效,但通常效果较差且可能产生不足的检测性能。受此启发,我们提出了QTyBERT,一种新的语义日志表示方法,能够更好地平衡这种权衡。QTyBERT使用SysBE,一种轻量级的BERT变体,具有系统特定的量化,以在CPU上高效地将日志事件编码为向量嵌入,并利用CroSysEh增强这些日志嵌入的语义表达性。CroSysEh通过使用多个系统的无标签日志进行无监督训练,以捕捉BERT模型嵌入空间下的潜在语义结构。我们评估了QTyBERT与现有语义日志表示方法的性能。结果表明,对于深度学习模型,使用QTyBERT生成的日志嵌入在检测效果上与或优于BERT生成的日志嵌入,同时使日志嵌入生成时间接近静态词嵌入方法。

英文摘要:

Recent deep learning (DL) methods for log anomaly detection increasingly rely on semantic log representation methods that convert the textual content of log events into vector embeddings as input to DL models. However, these DL methods are typically evaluated as end-to-end pipelines, while the impact of different semantic representation methods is not well understood. In this paper, we benchmark widely used semantic log representation methods, including static word embedding methods (Word2Vec, GloVe, and FastText) and the BERT-based contextual embedding method, across diverse DL models for log-event level anomaly detection on three publicly available log datasets: BGL, Thunderbird, and Spirit. We identify an effectiveness--efficiency trade off under CPU deployment settings: the BERT-based method is more effective, but incurs substantially longer log embedding generation time, limiting its practicality; static word embedding methods are efficient but are generally less effective and may yield insufficient detection performance. Motivated by this finding, we propose QTyBERT, a novel semantic log representation method that better balances this trade-off. QTyBERT uses SysBE, a lightweight BERT variant with system-specific quantization, to efficiently encode log events into vector embeddings on CPUs, and leverages CroSysEh to enhance the semantic expressiveness of these log embeddings. CroSysEh is trained unsupervisedly using unlabeled logs from multiple systems to capture the underlying semantic structure of the BERT model's embedding space. We evaluate QTyBERT against existing semantic log representation methods. Our results show that, for the DL models, using QTyBERT-generated log embeddings achieves detection effectiveness comparable to or better than BERT-generated log embeddings, while bringing log embedding generation time closer to that of static word embedding methods.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑