What Information Contributes to Log-based Anomaly Detection? Insights from a Configurable Transformer-Based Approach Article Swipe

MAKE IMPACT

Xingfang Wu , Heng Li , Foutse Khomh · YOU? · · 2024 · Open Access · · DOI: https://doi.org/10.48550/arxiv.2409.20503

Log data are generated from logging statements in the source code, providing insights into the execution processes of software applications and systems. State-of-the-art log-based anomaly detection approaches typically leverage deep learning models to capture the semantic or sequential information in the log data and detect anomalous runtime behaviors. However, the impacts of these different types of information are not clear. In addition, most existing approaches ignore the timestamps in log data, which can potentially provide fine-grained sequential and temporal information. In this work, we propose a configurable Transformer-based anomaly detection model that can capture the semantic, sequential, and temporal information in the log data and allows us to configure the different types of information as the model's features. Additionally, we train and evaluate the proposed model using log sequences of different lengths, thus overcoming the constraint of existing methods that rely on fixed-length or time-windowed log sequences as inputs. With the proposed model, we conduct a series of experiments with different combinations of input features to evaluate the roles of different types of information in anomaly detection. The model can attain competitive and consistently stable performance compared to the baselines when presented with log sequences of varying lengths. The results indicate that the event occurrence information plays a key role in identifying anomalies, while the impact of the sequential and temporal information is not significant for anomaly detection on the studied public datasets. On the other hand, the findings also reveal the simplicity of the studied public datasets and highlight the importance of constructing new datasets that contain different types of anomalies to better evaluate the performance of anomaly detection models.

Type

preprint

Language

en

Landing Page

http://arxiv.org/abs/2409.20503

PDF

https://arxiv.org/pdf/2409.20503

OA Status

green

Related Works

10

OpenAlex ID

https://openalex.org/W4403816269

Raw OpenAlex JSON

OpenAlex ID

https://openalex.org/W4403816269

Canonical identifier for this work in OpenAlex

DOI

https://doi.org/10.48550/arxiv.2409.20503

Digital Object Identifier

Title

What Information Contributes to Log-based Anomaly Detection? Insights from a Configurable Transformer-Based Approach

Work title

Type

preprint

OpenAlex work type

Language

en

Primary language

Publication year

2024

Year of publication

Publication date

2024-09-30

Full publication date if available

Authors

Xingfang Wu, Heng Li, Foutse Khomh

List of authors in order

Landing page

https://arxiv.org/abs/2409.20503

Publisher landing page

PDF URL

https://arxiv.org/pdf/2409.20503

Direct link to full text PDF

Open access

Yes

Whether a free full text is available

OA status

green

Open access status per OpenAlex

OA URL

https://arxiv.org/pdf/2409.20503

Direct OA link when available

Concepts

Anomaly detection, Transformer, Anomaly (physics), Computer science, Data mining, Engineering, Electrical engineering, Physics, Voltage, Condensed matter physics

Top concepts (fields/topics) attached by OpenAlex

Cited by

0

Total citation count in OpenAlex

Related works (count)

10

Other works algorithmically related by OpenAlex

Full payload