PULL: Reactive Log Anomaly Detection Based On Iterative PU Learning

Simple item page
dc.contributor.authorWittkopp, Thorsten
dc.contributor.authorScheinert, Dominik
dc.contributor.authorWiesner, Philipp
dc.contributor.authorAcker, Alexander
dc.contributor.authorKao, Odej
dc.date.accessioned2022-12-27T18:58:38Z
dc.date.available2022-12-27T18:58:38Z
dc.date.issued2023-01-03
dc.description.abstractDue to the complexity of modern IT services, failures can be manifold, occur at any stage, and are hard to detect. For this reason, anomaly detection applied to monitoring data such as logs allows gaining relevant insights to improve IT services steadily and eradicate failures. However, existing anomaly detection methods that provide high accuracy often rely on labeled training data, which are time-consuming to obtain in practice. Therefore, we propose PULL, an iterative log analysis method for reactive anomaly detection based on estimated failure time windows provided by monitoring systems instead of labeled data. Our attention-based model uses a novel objective function for weak supervision deep learning that accounts for imbalanced data and applies an iterative learning strategy for positive and unknown samples (PU learning) to identify anomalous logs. Our evaluation shows that PULL consistently outperforms ten benchmark baselines across three different datasets and detects anomalous log messages with an F1-score of more than 0.99 even within imprecise failure time windows.
dc.format.extent10
dc.identifier.doi10.24251/HICSS.2023.172
dc.identifier.isbn978-0-9981331-6-4
dc.identifier.urihttps://hdl.handle.net/10125/102802
dc.language.isoeng
dc.relation.ispartofProceedings of the 56th Hawaii International Conference on System Sciences
dc.rightsAttribution-NonCommercial-NoDerivatives 4.0 International
dc.rights.urihttps://creativecommons.org/licenses/by-nc-nd/4.0/
dc.subjectService Analytics
dc.subjectdependability
dc.subjectlog anomaly detection
dc.subjectservice reliability
dc.subjectweak supervision
dc.titlePULL: Reactive Log Anomaly Detection Based On Iterative PU Learning
dc.type.dcmitext
prism.startingpage1376

Files

Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
0135.pdf
Size:
498.72 KB
Format:
Adobe Portable Document Format
Download

Collections

Service Analytics