Log anomaly detection plays a critical role in ensuring the security and
maintenance of modern software systems. At present, the primary approach for
detecting anomalies in log data is through supervised anomaly detection.
Nonetheless, existing supervised methods heavily rely on labeled data, which
can be frequently limited in real-world scenarios. In this paper, we propose a
semi-supervised log anomaly detection method that combines the DQN algorithm
from deep reinforcement learning, which is called DQNLog. DQNLog leverages a
small amount of labeled data and a large-scale unlabeled dataset, effectively
addressing the challenges of imbalanced data and limited labeling. This
approach not only learns known anomalies by interacting with an environment
biased towards anomalies but also discovers unknown anomalies by actively
exploring the unlabeled dataset. Additionally, DQNLog incorporates a
cross-entropy loss term to prevent model overestimation during Deep
Reinforcement Learning (DRL). Our evaluation on three widely-used datasets
demonstrates that DQNLog significantly improves recall rate and F1-score while
maintaining precision, validating its practicality.

本文提出了一种名为 DQNLog 的半监督日志异常检测方法，它结合了来自深度强化学习的 DQN 算法，通过有效地利用少量标记数据和大规模未标记数据集，解决了数据不平衡和标记不足的挑战，不仅可以学习已知异常，还可以主动探索未标记数据集以发现未知异常，并在深度强化学习中引入了交叉熵损失项以防止模型过高估计，通过对三个广泛使用的数据集的评估，证明 DQNLog 在提高召回率和 F1 分数的同时保持精确度，验证了其实用性。

通过 DQN 进行半监督学习的日志异常检测

Semi-supervised learning via DQN for log anomaly detection

The inability to linearly classify XOR has motivated much of deep learning.
We revisit this age-old problem and show that linear classification of XOR is
indeed possible. Instead of separating data between halfspaces, we propose a
slightly different paradigm, equality separation, that adapts the SVM objective
to distinguish data within or outside the margin. Our classifier can then be
integrated into neural network pipelines with a smooth approximation. From its
properties, we intuit that equality separation is suitable for anomaly
detection. To formalize this notion, we introduce closing numbers, a
quantitative measure on the capacity for classifiers to form closed decision
regions for anomaly detection. Springboarding from this theoretical connection
between binary classification and anomaly detection, we test our hypothesis on
supervised anomaly detection experiments, showing that equality separation can
detect both seen and unseen anomalies.

无法线性分类 XOR 激发了深度学习的很多研究。我们重新审视这个古老的问题并证明线性分类 XOR 是可能的。我们提出了一种稍微不同的范式，即等式分离，将 SVM 目标适应于区分数据在或超过边界之外。我们的分类器可以与神经网络流水线集成，并进行平滑逼近。根据其属性，我们直觉等式分离适用于异常检测。为了形式化这个概念，我们引入了封闭数字，这是对分类器形成封闭决策区域的容量的定量度量。基于这个二元分类与异常检测之间的理论联系，我们在监督异常检测实验中测试了我们的假设，结果显示等式分离可以检测到已知和未知的异常。

非可分二元分类及其在异常检测中的应用再思考

Revisiting Non-separable Binary Classification and its Applications in  Anomaly Detection

The scarcity of annotated data, particularly for rare diseases, limits the
variability of training data and the range of detectable lesions, presenting a
significant challenge for supervised anomaly detection in medical imaging. To
solve this problem, we propose a novel unsupervised method for medical image
anomaly detection: Attention-Augmented Differentiable top-k Feature Adaptation
(ADFA). The method utilizes Wide-ResNet50-2 (WR50) network pre-trained on
ImageNet to extract initial feature representations. To reduce the channel
dimensionality while preserving relevant channel information, we employ an
attention-augmented patch descriptor on the extracted features. We then apply
differentiable top-k feature adaptation to train the patch descriptor, mapping
the extracted feature representations to a new vector space, enabling effective
detection of anomalies. Experiments show that ADFA outperforms state-of-the-art
(SOTA) methods on multiple challenging medical image datasets, confirming its
effectiveness in medical anomaly detection.

稀缺的注释数据，尤其是罕见疾病的数据，限制了训练数据的多样性和可检测病变的范围，对医学影像中的监督异常检测提出了重大挑战。为了解决这个问题，我们提出了一种新的无监督医学图像异常检测方法：Attention-Augmented Differentiable top-k Feature Adaptation (ADFA)。该方法利用在 ImageNet 上预训练的 Wide-ResNet50-2 (WR50) 网络提取初始特征表示。为了减少通道维度，同时保留相关通道信息，我们在提取的特征上使用了增强型注意力补丁描述符。然后，我们应用可微分的 top-k 特征适应方法来训练补丁描述符，将提取的特征表示映射到一个新的向量空间，实现有效的异常检测。实验结果显示，ADFA 在多个具有挑战性的医学影像数据集上优于最先进的（SOTA）方法，证实了其在医学异常检测中的有效性。