Log analysis is one of the main techniques engineers use to troubleshoot faults of large-scale software systems. During the past decades, many log analysis approaches have been proposed to detect system anomalies reflected by logs. They usually take log event counts or sequential log events as inputs and utilize machine learning algorithms including deep learning models to detect system anomalies. These anomalies are often identified as violations of quantitative relational patterns or sequential patterns of log events in log sequences. However, existing methods fail to leverage the spatial structural relationships among log events, resulting in potential false alarms and unstable performance. In this study, we propose a novel graph-based log anomaly detection method, LogGD, to effectively address the issue by transforming log sequences into graphs. We exploit the powerful capability of Graph Transformer Neural Network, which combines graph structure and node semantics for log-based anomaly detection. We evaluate the proposed method on four widely-used public log datasets. Experimental results show that LogGD can outperform state-of-the-art quantitative-based and sequence-based methods and achieve stable performance under different window size settings. The results confirm that LogGD is effective in log-based anomaly detection.
翻译:日志分析是用于解决大型软件系统故障的主要技术工程师使用的方法之一。在过去几十年中,提出了许多日志分析方法,以检测日志反映的系统异常现象。它们通常将日志统计或序列日志活动作为投入,并使用机器学习算法,包括深层学习模型,以探测系统异常现象。这些异常现象往往被确定为在日志序列中违反定量关系模式或日志事件顺序模式。然而,现有方法未能利用日志事件之间的空间结构关系,导致潜在的虚假警报和不稳定性性能。在本研究中,我们提出了一种基于图表的新颖的日志异常现象探测方法,即LogGD,以通过将日志序列转换成图表来有效解决这一问题。我们利用Greg Tranger Neal 网络的强大能力,它将图表结构与基于日志的异常现象探测方法结合起来。我们评估了四种广泛使用的公共日志数据集的拟议方法。实验结果表明,LgGD可以超越基于定量和序列的状态方法,并在不同的窗口大小设置下实现稳定性能。结果证实LgGD在基于日志的异常现象探测中是有效的。