In spite of the rapid advancements in unsupervised log anomaly detection
techniques, the current mainstream models still necessitate specific training
for individual system datasets, resulting in costly procedures and limited
scalability due to dataset size, thereby leading to performance bottlenecks.
Furthermore, numerous models lack cognitive reasoning capabilities, posing
challenges in direct transferability to similar systems for effective anomaly
detection. Additionally, akin to reconstruction networks, these models often
encounter the "identical shortcut" predicament, wherein the majority of system
logs are classified as normal, erroneously predicting normal classes when
confronted with rare anomaly logs due to reconstruction errors.
To address the aforementioned issues, we propose MLAD, a novel anomaly
detection model that incorporates semantic relational reasoning across multiple
systems. Specifically, we employ Sentence-bert to capture the similarities
between log sequences and convert them into highly-dimensional learnable
semantic vectors. Subsequently, we revamp the formulas of the Attention layer
to discern the significance of each keyword in the sequence and model the
overall distribution of the multi-system dataset through appropriate vector
space diffusion. Lastly, we employ a Gaussian mixture model to highlight the
uncertainty of rare words pertaining to the "identical shortcut" problem,
optimizing the vector space of the samples using the maximum expectation model.
Experiments on three real-world datasets demonstrate the superiority of MLAD.

提出了一种新的异常检测模型 MLAD，该模型通过语义关系推理跨越多个系统。实验证明了 MLAD 的优越性。