A2Log: Attentive Augmented Log Anomaly Detection

Date
2022-01-04
Authors
Wittkopp, Thorsten
Acker, Alexander
Nedelkoski, Sasho
Bogatinovski, Jasmin
Scheinert, Dominik
Fan, Wu
Kao, Odej
Journal Title
Journal ISSN
Volume Title
Publisher
Abstract
Anomaly detection becomes increasingly important for the dependability and serviceability of IT services. As log lines record events during the execution of IT services, they are a primary source for diagnostics. Thereby, unsupervised methods provide a significant benefit since not all anomalies can be known at training time. Existing unsupervised methods need anomaly examples to obtain a suitable decision boundary required for the anomaly detection task. This requirement poses practical limitations. Therefore, we develop A2Log, which is an unsupervised anomaly detection method consisting of two steps: Anomaly scoring and anomaly decision. First, we utilize a self-attention neural network to perform the scoring for each log message. Second, we set the decision boundary based on data augmentation of the available normal training data. The method is evaluated on three publicly available datasets and one industry dataset. We show that our approach outperforms existing methods. Furthermore, we utilize available anomaly examples to set optimal decision boundaries to acquire strong baselines. We show that our approach, which determines decision boundaries without utilizing anomaly examples, can reach scores of the strong baselines.
Description
Keywords
Service Analytics, anomaly detection, data augmentation, log data analysis, machine learning, service systems
Citation
Rights
Access Rights
Email libraryada-l@lists.hawaii.edu if you need this content in ADA-compliant format.