Log anomaly detection plays a critical role in ensuring the security and maintenance of modern software systems. At present, the primary approach for detecting anomalies in log data is through supervised anomaly detection. Nonetheless, existing supervised methods heavily rely on labeled data, which can be frequently limited in real-world scenarios. In this paper, we propose a semi-supervised log anomaly detection method that combines the DQN algorithm from deep reinforcement learning, which is called DQNLog. DQNLog leverages a small amount of labeled data and a large-scale unlabeled dataset, effectively addressing the challenges of imbalanced data and limited labeling. This approach not only learns known anomalies by interacting with an environment biased towards anomalies but also discovers unknown anomalies by actively exploring the unlabeled dataset. Additionally, DQNLog incorporates a cross-entropy loss term to prevent model overestimation during Deep Reinforcement Learning (DRL). Our evaluation on three widely-used datasets demonstrates that DQNLog significantly improves recall rate and F1-score while maintaining precision, validating its practicality.

本文提出了一种名为DQNLog的半监督日志异常检测方法，它结合了来自深度强化学习的DQN算法，通过有效地利用少量标记数据和大规模未标记数据集，解决了数据不平衡和标记不足的挑战，不仅可以学习已知异常，还可以主动探索未标记数据集以发现未知异常，并在深度强化学习中引入了交叉熵损失项以防止模型过高估计，通过对三个广泛使用的数据集的评估，证明DQNLog在提高召回率和F1分数的同时保持精确度，验证了其实用性。

通过DQN进行半监督学习的日志异常检测