Nowadays large computers extensively output logs to record the runtime status
and it has become crucial to identify any suspicious or malicious activities
from the information provided by the realtime logs. Thus, fast log anomaly
detection is a necessary task to be implemented for automating the infeasible
manual detection. Most of the existing unsupervised methods are trained only on
normal log data, but they usually require either additional abnormal data for
hyperparameter selection or auxiliary datasets for discriminative model
optimization. In this paper, aiming for a highly effective discriminative model
that enables rapid anomaly detection,we propose FastLogAD, a
generator-discriminator framework trained to exhibit the capability of
generating pseudo-abnormal logs through the Mask-Guided Anomaly Generation
(MGAG) model and efficiently identifying the anomalous logs via the
Discriminative Abnormality Separation (DAS) model. Particularly,
pseudo-abnormal logs are generated by replacing randomly masked tokens in a
normal sequence with unlikely candidates. During the discriminative stage,
FastLogAD learns a distinct separation between normal and pseudoabnormal
samples based on their embedding norms, allowing the selection of a threshold
without exposure to any test data and achieving competitive performance.
Extensive experiments on several common benchmarks show that our proposed
FastLogAD outperforms existing anomaly detection approaches. Furthermore,
compared to previous methods, FastLogAD achieves at least x10 speed increase in
anomaly detection over prior work. Our implementation is available at
this https URL

现今大型计算机广泛输出日志以记录运行状态，因此从实时日志信息中准确识别出可疑或恶意活动已变得至关重要。因此，快速日志异常检测成为自动化不可行的手动检测的必要任务。本文介绍了 FastLogAD，这是一个生成器 - 辨别器框架，通过 Mask-Guided Anomaly Generation（MGAG）模型生成伪异常日志，并通过 Discriminative Abnormality Separation（DAS）模型高效地识别异常日志，旨在实现高效的辨别模型，用于快速异常检测。通过在正常序列中随机替换被屏蔽令牌为不太可能的候选词，生成伪异常日志。在辨别阶段，FastLogAD 基于嵌入范数学习正常样本和伪异常样本之间的明显区别，并且无需接触任何测试数据即可选择阈值，从而实现具有竞争性性能的异常检测。在几个常见基准测试上进行了大量实验，结果表明我们提出的 FastLogAD 优于现有的异常检测方法。此外，与先前的方法相比，FastLogAD 实现了至少 10 倍的异常检测速度提升。我们的实现代码可在此 URL 找到。