The realm of AIOps is transforming IT landscapes with the power of AI and ML.
Despite the challenge of limited labeled data, supervised models show promise,
emphasizing the importance of leveraging labels for training, especially in
deep learning contexts. This study enhances the field by introducing a taxonomy
for log anomalies and exploring automated data labeling to mitigate labeling
challenges. It goes further by investigating the potential of diverse anomaly
detection techniques and their alignment with specific anomaly types. However,
the exploration doesn't stop at anomaly detection. The study envisions a future
where root cause analysis follows anomaly detection, unraveling the underlying
triggers of anomalies. This uncharted territory holds immense potential for
revolutionizing IT systems management. In essence, this paper enriches our
understanding of anomaly detection, and automated labeling, and sets the stage
for transformative root cause analysis. Together, these advances promise more
resilient IT systems, elevating operational efficiency and user satisfaction in
an ever-evolving technological landscape.

该研究引入了一个日志异常的分类法，并探索了自动数据标记来减轻标记挑战，同时研究了多种异常检测技术及其与特定异常类型的相互对齐关系。这篇论文丰富了我们对异常检测和自动标注的理解，为变革性的根本原因分析奠定了基础，从而使 IT 系统更具弹性，提升运营效率并提高用户满意度。

从异常检测到自动日志标记和开创性根本原因分析的进展

Progressing from Anomaly Detection to Automated Log Labeling and  Pioneering Root Cause Analysis

Anomaly detection techniques are essential in automating the monitoring of IT
systems and operations. These techniques imply that machine learning algorithms
are trained on operational data corresponding to a specific period of time and
that they are continuously evaluated on newly emerging data. Operational data
is constantly changing over time, which affects the performance of deployed
anomaly detection models. Therefore, continuous model maintenance is required
to preserve the performance of anomaly detectors over time. In this work, we
analyze two different anomaly detection model maintenance techniques in terms
of the model update frequency, namely blind model retraining and informed model
retraining. We further investigate the effects of updating the model by
retraining it on all the available data (full-history approach) and on only the
newest data (sliding window approach). Moreover, we investigate whether a data
change monitoring tool is capable of determining when the anomaly detection
model needs to be updated through retraining.

在这项工作中，我们分析了两种不同的异常检测模型维护技术的模型更新频率，即盲目模型重训练和知情模型重训练。此外，我们还研究了通过对所有可用数据（全历史方法）或仅对最新数据（滑动窗口方法）进行重新训练来更新模型的效果，并且调查了一个数据变化监控工具能否确定何时需要通过重新训练更新异常检测模型。

异常检测 AIOps 解决方案的维护技术

Maintenance Techniques for Anomaly Detection AIOps Solutions

Log data store event execution patterns that correspond to underlying
workflows of systems or applications. While most logs are informative, log data
also include artifacts that indicate failures or incidents. Accordingly, log
data are often used to evaluate anomaly detection techniques that aim to
automatically disclose unexpected or otherwise relevant system behavior
patterns. Recently, detection approaches leveraging deep learning have
increasingly focused on anomalies that manifest as changes of sequential
patterns within otherwise normal event traces. Several publicly available data
sets, such as HDFS, BGL, Thunderbird, OpenStack, and Hadoop, have since become
standards for evaluating these anomaly detection techniques, however, the
appropriateness of these data sets has not been closely investigated in the
past. In this paper we therefore analyze six publicly available log data sets
with focus on the manifestations of anomalies and simple techniques for their
detection. Our findings suggest that most anomalies are not directly related to
sequential manifestations and that advanced detection techniques are not
required to achieve high detection rates on these data sets.

本篇研究分析了六个公开可用的日志数据集，关注异常的表现形式和简单的检测技术，结果显示大多数异常与顺序表现无直接联系，不需要先进的检测技术即可实现对这些数据集的高检测率。