The rapid growth of deep learning (DL) has spurred interest in enhancing
log-based anomaly detection. This approach aims to extract meaning from log
events (log message templates) and develop advanced DL models for anomaly
detection. However, these DL methods face challenges like heavy reliance on
training data, labels, and computational resources due to model complexity. In
contrast, traditional machine learning and data mining techniques are less
data-dependent and more efficient but less effective than DL. To make log-based
anomaly detection more practical, the goal is to enhance traditional techniques
to match DL's effectiveness. Previous research in a different domain (linking
questions on Stack Overflow) suggests that optimized traditional techniques can
rival state-of-the-art DL methods. Drawing inspiration from this concept, we
conducted an empirical study. We optimized the unsupervised PCA (Principal
Component Analysis), a traditional technique, by incorporating lightweight
semantic-based log representation. This addresses the issue of unseen log
events in training data, enhancing log representation. Our study compared seven
log-based anomaly detection methods, including four DL-based, two traditional,
and the optimized PCA technique, using public and industrial datasets. Results
indicate that the optimized unsupervised PCA technique achieves similar
effectiveness to advanced supervised/semi-supervised DL methods while being
more stable with limited training data and resource-efficient. This
demonstrates the adaptability and strength of traditional techniques through
small yet impactful adaptations.

通过对传统技术进行优化，我们实现了无监督主成分分析（PCA）技术的优化，通过轻量级的基于语义的日志表示解决了训练数据中未知日志事件的问题，提高了日志表示的效果，我们的研究比较了公共和工业数据集上的七种基于日志的异常检测方法，包括四种 DL-based 方法、两种传统方法和优化的 PCA 技术，结果表明，优化的无监督 PCA 技术在有限的训练数据和资源效率方面达到了与先进的监督 / 半监督 DL 方法相似的效果，从而证明了传统技术通过小而重要的改进具有的适应性和优势。