LTAnomaly: A Transformer Variant for Syslog Anomaly Detection Based on Multi-Scale Representation and Long Sequence Capture
-
Published:2023-06-28
Issue:13
Volume:13
Page:7668
-
ISSN:2076-3417
-
Container-title:Applied Sciences
-
language:en
-
Short-container-title:Applied Sciences
Author:
Han Delong12, Sun Mengjie12, Li Min12, Chen Qinghui12
Affiliation:
1. Key Laboratory of Computing Power Network and Information Security, Ministry of Education, Shandong Computer Science Center (National Supercomputer Center in Jinan), Qilu University of Technology (Shandong Academy of Sciences), Jinan 250014, China 2. Shandong Provincial Key Laboratory of Computer Networks, Shandong Fundamental Research Center for Computer Science, Jinan 250353, China
Abstract
Detailed information on system operation is recorded by system logs, from which fast and accurate detection of anomalies is conducive to service management and system maintenance. Log anomaly detection methods often only handle a single type of anomaly, and the utilization of log messages could be higher, which makes it challenging to improve the performance of log anomaly detection models. This article presents the LTAnomaly model to accomplish log anomaly detection using semantic information, sequence relationships, and component values to make a vector representation of logs, and we add Transformer with long short-term memory (LSTM) as our final classification model. When sequences are processed sequentially, the model is also influenced by the information from the global information, thus increasing the dependence on feature information. This improves the utilization of log messages with a flexible, simple, and robust model. To evaluate the effectiveness of our method, experiments are performed on the HDFS and BGL datasets, with the F1-measures reaching 0.985 and 0.975, respectively, showing that the proposed method enjoys higher accuracy and a more comprehensive application range than existing models.
Funder
National Key Research and Development Program of China Qilu University of Technology
Subject
Fluid Flow and Transfer Processes,Computer Science Applications,Process Chemistry and Technology,General Engineering,Instrumentation,General Materials Science
Reference46 articles.
1. Eliciting and Utilising Knowledge for Security Event Log Analysis: An Association Rule Mining and Automated Planning Approach;Khan;Expert Syst. Appl.,2018 2. Meng, W., Liu, Y., Zhu, Y., Zhang, S., Pei, D., Liu, Y., Chen, Y., Zhang, R., Tao, S., and Sun, P. (2019, January 10–16). Loganomaly: Unsupervised Detection of Sequential and Quantitative Anomalies in Unstructured Logs. Proceedings of the 28th International Joint Conference on Artificial Intelligence, IJCAI’19, Macao, China. 3. Gao, P., Xiao, X., Li, D., Li, Z., Jee, K., Wu, Z., Kim, C.H., Kulkarni, S.R., and Mittal, P. (2018, January 15–17). SAQL: A Stream-Based Query System for Real-Time Abnormal System Behavior Detection. Proceedings of the 27th USENIX Conference on Security Symposium, SEC’18, Berkeley, CA, USA. 4. Gao, P., Xiao, X., Li, Z., Jee, K., Xu, F., Kulkarni, S.R., and Mittal, P. (2018, January 11–13). AIQL: Enabling Efficient Attack Investigation from System Monitoring Data. Proceedings of the 2018 USENIX Conference on Usenix Annual Technical Conference, USENIX ATC ’18, Boston, MA, USA. 5. Xu, W., Huang, L., Fox, A., Patterson, D., and Jordan, M.I. (2009, January 11–14). Detecting Large-Scale System Problems by Mining Console Logs. Proceedings of the ACM SIGOPS 22nd Symposium on Operating Systems Principles, SOSP ’09, New York, NY, USA.
|
|