Most enterprise applications use logging as a mechanism to diagnose
anomalies, which could help with reducing system downtime. Anomaly detection
using software execution logs has been explored in several prior studies, using
both classical and deep neural network-based machine learning models. In recent
years, the research has largely focused in using variations of sequence-based
deep neural networks (e.g., Long-Short Term Memory and Transformer-based
models) for log-based anomaly detection on open-source data. However, they have
not been applied in industrial datasets, as often. In addition, the studied
open-source datasets are typically very large in size with logging statements
that do not change much over time, which may not be the case with a dataset
from an industrial service that is relatively new. In this paper, we evaluate
several state-of-the-art anomaly detection models on an industrial dataset from
our research partner, which is much smaller and loosely structured than most
large scale open-source benchmark datasets. Results show that while all models
are capable of detecting anomalies, certain models are better suited for
less-structured datasets. We also see that model effectiveness changes when a
common data leak associated with a random train-test split in some prior work
is removed. A qualitative study of the defects' characteristics identified by
the developers on the industrial dataset further shows strengths and weaknesses
of the models in detecting different types of anomalies. Finally, we explore
the effect of limited training data by gradually increasing the training set
size, to evaluate if the model effectiveness does depend on the training set
size.

对比多个先进的异常检测模型在工业数据集上的表现，结果显示某些模型更适用于结构较松散的数据集，并且研究人员通过定性研究分析了这些模型在识别不同类型的异常时的优势和局限性，最后对训练集大小进行逐渐增加并评估模型的有效性。

企业软件的基于日志的异常检测：一个实证研究

Log-based Anomaly Detection of Enterprise Software: An Empirical Study

Almost 50 years after the invention of SQL, injection attacks are still
top-tier vulnerabilities of today's ICT systems. Consequently, SQLi detection
is still an active area of research, where the most recent works incorporate
machine learning techniques into the proposed solutions. In this work, we
highlight the shortcomings of the previous ML-based results focusing on four
aspects: the evaluation methods, the optimization of the model parameters, the
distribution of utilized datasets, and the feature selection. Since no single
work explored all of these aspects satisfactorily, we fill this gap and provide
an in-depth and comprehensive empirical analysis. Moreover, we cross-validate
the trained models by using data from other distributions. This aspect of ML
models (trained for SQLi detection) was never studied. Yet, the sensitivity of
the model's performance to this is crucial for any real-life deployment.
Finally, we validate our findings on a real-world industrial SQLi dataset.

本研究着重探讨了前人机器学习模型在 SQL 注入检测中的不足，包括评估方法、模型参数的优化、数据集的分布和特征选择。结合实验证明该模型对数据集的敏感性及其在工业数据集中的应用。