System logs are some of the most important information for the maintenance of
software systems, which have become larger and more complex in recent years.
The goal of log-based anomaly detection is to automatically detect system
anomalies by analyzing the large number of logs generated in a short period of
time, which is a critical challenge in the real world. Previous studies have
used a log parser to extract templates from unstructured log data and detect
anomalies on the basis of patterns of the template occurrences. These methods
have limitations for logs with unknown templates. Furthermore, since most log
anomalies are known to be point anomalies rather than contextual anomalies,
detection methods based on occurrence patterns can cause unnecessary delays in
detection. In this paper, we propose LogELECTRA, a new log anomaly detection
model that analyzes a single line of log messages more deeply on the basis of
self-supervised anomaly detection. LogELECTRA specializes in detecting log
anomalies as point anomalies by applying ELECTRA, a natural language processing
model, to analyze the semantics of a single line of log messages. LogELECTRA
outperformed existing state-of-the-art methods in experiments on the public
benchmark log datasets BGL, Sprit, and Thunderbird.

我们提出了一种新的日志异常检测模型 LogELECTRA，通过应用 ELECTRA 自然语言处理模型来分析单行日志消息的语义，LogELECTRA 专门用于检测点异常的日志异常，并在公共基准日志数据集 BGL、Sprit 和 Thunderbird 的实验中优于现有的最先进方法。

LogELECTRA：无结构日志的自监督异常检测

LogELECTRA: Self-supervised Anomaly Detection for Unstructured Logs

The increasing volume of log data produced by software-intensive systems
makes it impractical to analyze them manually. Many deep learning-based methods
have been proposed for log-based anomaly detection. These methods face several
challenges such as high-dimensional and noisy log data, class imbalance,
generalization, and model interpretability. Recently, ChatGPT has shown
promising results in various domains. However, there is still a lack of study
on the application of ChatGPT for log-based anomaly detection. In this work, we
proposed LogGPT, a log-based anomaly detection framework based on ChatGPT. By
leveraging the ChatGPT's language interpretation capabilities, LogGPT aims to
explore the transferability of knowledge from large-scale corpora to log-based
anomaly detection. We conduct experiments to evaluate the performance of LogGPT
and compare it with three deep learning-based methods on BGL and Spirit
datasets. LogGPT shows promising results and has good interpretability. This
study provides preliminary insights into prompt-based models, such as ChatGPT,
for the log-based anomaly detection task.

通过 ChatGPT 的语言解释能力，本研究提出了基于 ChatGPT 的 LogGPT 框架，旨在探索将大规模语料库的知识转移应用于基于日志的异常检测。在 BGL 和 Spirit 数据集上，通过与三种基于深度学习的方法进行比较，实验评估了 LogGPT 的性能，显示出良好的可解释性和有希望的结果。该研究初步揭示了 ChatGPT 等基于提示的模型在基于日志的异常检测任务中的潜力。

LogGPT：基于日志的异常检测的 ChatGPT 探索

LogGPT: Exploring ChatGPT for Log-Based Anomaly Detection

The rapid growth of deep learning (DL) has spurred interest in enhancing
log-based anomaly detection. This approach aims to extract meaning from log
events (log message templates) and develop advanced DL models for anomaly
detection. However, these DL methods face challenges like heavy reliance on
training data, labels, and computational resources due to model complexity. In
contrast, traditional machine learning and data mining techniques are less
data-dependent and more efficient but less effective than DL. To make log-based
anomaly detection more practical, the goal is to enhance traditional techniques
to match DL's effectiveness. Previous research in a different domain (linking
questions on Stack Overflow) suggests that optimized traditional techniques can
rival state-of-the-art DL methods. Drawing inspiration from this concept, we
conducted an empirical study. We optimized the unsupervised PCA (Principal
Component Analysis), a traditional technique, by incorporating lightweight
semantic-based log representation. This addresses the issue of unseen log
events in training data, enhancing log representation. Our study compared seven
log-based anomaly detection methods, including four DL-based, two traditional,
and the optimized PCA technique, using public and industrial datasets. Results
indicate that the optimized unsupervised PCA technique achieves similar
effectiveness to advanced supervised/semi-supervised DL methods while being
more stable with limited training data and resource-efficient. This
demonstrates the adaptability and strength of traditional techniques through
small yet impactful adaptations.

通过对传统技术进行优化，我们实现了无监督主成分分析（PCA）技术的优化，通过轻量级的基于语义的日志表示解决了训练数据中未知日志事件的问题，提高了日志表示的效果，我们的研究比较了公共和工业数据集上的七种基于日志的异常检测方法，包括四种 DL-based 方法、两种传统方法和优化的 PCA 技术，结果表明，优化的无监督 PCA 技术在有限的训练数据和资源效率方面达到了与先进的监督 / 半监督 DL 方法相似的效果，从而证明了传统技术通过小而重要的改进具有的适应性和优势。