PaperlayerView exact revision on arXiv

Source-linked AI summary

FastLogAD: Log Anomaly Detection with Mask-Guided Pseudo Anomaly Generation and Discrimination

Yifei Lin, Hanqiu Deng, Xingyu Li

arXiv:2404.08750v1cs.LG

TL;DR

Unsupervised log anomaly detectors may need abnormal data for tuning or auxiliary data for training, limiting their use with target-domain normal logs alone. FastLogAD generates pseudo-abnormal logs to train a discriminator, and reports top F1-scores with at least x10 faster detection than prior work.

  • Problem

    Unsupervised log detectors may require abnormal data for hyperparameter selection or auxiliary data for discriminator training, which may not represent the target domain.

    Source: §1 · p. 2

  • Method

    FastLogAD generates pseudo-abnormal logs from normal sequences and trains a discriminator to separate them from normal logs using output norms.

    Source: §1 · p. 2

  • Results

    On HDFS, BGL, and Thunderbird, FastLogAD reports the highest F1-scores and at least x10 detection speed increase over prior work.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Only the discriminator is used at inference, facilitating swift log analysis with high throughput.

    Source: §3 · p. 3

    FastLogAD has comparatively lower precision, with false positives particularly for test sequences outside the training vocabulary that become [unk] tokens.

    Source: §5 · p. 8

Abstract

from arXiv · show

Nowadays large computers extensively output logs to record the runtime status and it has become crucial to identify any suspicious or malicious activities from the information provided by the realtime logs. Thus, fast log anomaly detection is a necessary task to be implemented for automating the infeasible manual detection. Most of the existing unsupervised methods are trained only on normal log data, but they usually require either additional abnormal data for hyperparameter selection or auxiliary datasets for discriminative model optimization. In this paper, aiming for a highly effective discriminative model that enables rapid anomaly detection,we propose FastLogAD, a generator-discriminator framework trained to exhibit the capability of generating pseudo-abnormal logs through the Mask-Guided Anomaly Generation (MGAG) model and efficiently identifying the anomalous logs via the Discriminative Abnormality Separation (DAS) model. Particularly, pseudo-abnormal logs are generated by replacing randomly masked tokens in a normal sequence with unlikely candidates. During the discriminative stage, FastLogAD learns a distinct separation between normal and pseudoabnormal samples based on their embedding norms, allowing the selection of a threshold without exposure to any test data and achieving competitive performance. Extensive experiments on several common benchmarks show that our proposed FastLogAD outperforms existing anomaly detection approaches. Furthermore, compared to previous methods, FastLogAD achieves at least x10 speed increase in anomaly detection over prior work. Our implementation is available at https://github.com/YifeiLin0226/FastLogAD.

1 INTRODUCTION

Log anomaly detection must handle large, complex log streams quickly, yet existing unsupervised approaches often rely on abnormal or auxiliary data. FastLogAD generates pseudo-anomalies to train a discriminator that separates them from normal logs.

1 INTRODUCTION

  • Large-scale logs make manual anomaly detection challenging, while high-throughput detection is important for timely identification of potential issues.The paper targets improved detection throughput without compromising accuracy.Source: §1 · pp. 1–2
  • Discriminative methods can depend on auxiliary abnormal data, while generative methods may require abnormal data for hyperparameter selection and have slower inference.Auxiliary data may not represent the target domain, potentially degrading deployment performance.Source: §1 · p. 2
  • FastLogAD uses Mask-Guided Anomaly Generation to create pseudo-anomalies and Discriminative Abnormality Separation to distinguish them from normal sequences.The discriminator separates samples using output norms, allowing a threshold based on normal instances without exposure to anomalous instances.Source: §1 · p. 2
  • On HDFS, BGL, and Thunderbird, FastLogAD reports the highest F1-scores and at least x10 detection speed increase over prior work.The paper describes this as real-time anomaly detection.Source: §1 · p. 2

2 RELATED WORK

The paper situates FastLogAD against log preprocessing practices and generative and discriminative anomaly detectors. It proposes generating synthetic abnormal logs from learned normal patterns and using them to train a discriminator.

2.1 Log Data Preprocessing

  • Raw logs are parsed, grouped, and tokenized before analysis; this study follows that preprocessing convention.The paper describes parsing messages into templates, grouping events into windows, and tokenizing structured logs.Source: §2.1 · pp. 2–3

2.2 Log Anomaly Detection Models

  • Prior generative detectors can require abnormal data to select k, while discriminative methods may use auxiliary logs that poorly represent the target domain.The related-work discussion names DeepLog, LogAnomaly, LogBERT [5], GlAD-PAW, and LogGPT [17] among generative approaches, and PLELog, Logsy [15], and A2log [21] among methods using other-source data.Source: §2.2 · p. 3
  • FastLogAD applies masked-guided sampling to a model of normal log patterns, generating synthetic abnormal logs to optimize a discriminator used at inference.The paper presents this as a one-class discriminative approach trained solely on normal logs from the target domain.Source: §2.2 · p. 3

3 METHODOLOGY

FastLogAD trains on normal log sequences and uses generated pseudo-abnormal samples to teach a discriminator to separate anomalous from normal sequences. Only the discriminator is used during inference.

3 METHODOLOGY

  • The methodology section introduces data preparation, problem formulation, and an overview of the training and inference system.It describes two generator variants: a training-free random generator and a trainable masked language model.Source: §3 · p. 3
  • Raw logs are prepared through parsing, grouping, and tokenization before model use.Drain assigns messages to existing or new templates; grouping uses session or sliding windows, and tokenization uses a vocabulary built from training logs.Source: §3 · p. 3
  • The task trains on a dataset of normal sequences and detects normal versus abnormal sequences in a test set.Training labels mark each training sequence as normal.Source: §3 · p. 3
  • FastLogAD uses a generator-discriminator architecture with Masked-Guided Anomaly Generation and Discriminative Abnormality Separation; only the discriminator runs at inference.The generator creates pseudo-abnormal samples for normal sequences during training, while the discriminator learns token-level and sequence-level distinctions.Source: §3 · p. 3

3.1 Mask-Guided Anomaly Generation

Mask-Guided Anomaly Generation creates pseudo-abnormal versions of normal log sequences by masking tokens and replacing them. FastLogAD offers a training-free random generator and a trained MLM generator for this task.

3.1 Mask-Guided Anomaly Generation

  • Randomly masked tokens are replaced to create a pseudo-abnormal counterpart for each normal training sequence.The masking ratio determines the percentage of tokens replaced with [mask].Source: §3.1 · pp. 3–4

3.1.1 Random Generator.

  • The random generator samples replacements from the vocabulary without training, reducing overhead but not learning token dependencies within a sequence.Masked positions are sampled uniformly from the vocabulary excluding the original token.Source: §3.1 · p. 4, §3.1.1 · p. 4

3.1.2 MLM Generator.

  • The MLM generator predicts a distribution over the vocabulary and replaces masked tokens with less likely candidates, producing more realistic abnormal sequences.Its effectiveness may diminish as vocabulary size increases, and it requires training.Source: §3.1 · p. 4, §3.1.2 · p. 4

3.1 Mask-Guided Anomaly Generation

  • Figure 3 shows masked normal sequences being passed through a generator during training, while Figure 4 shows inference using the discriminator directly.The complete pipeline parses and groups logs into sequences and uses a static vocabulary during inference.Source: Figure 2 · p. 4, Figure 3 · p. 5, Figure 4 · p. 5

3.2 Discriminative Abnormality Separation

Discriminative Abnormality Separation trains a BERT-based discriminator on normal and pseudo-abnormal sequences. Replaced Token Detection warms up token-level discrimination, while Hyperspherical Separation Training separates sequences using the [CLS] embedding norm.

3.2 Discriminative Abnormality Separation

  • The discriminator receives normal or pseudo-abnormal sequences with labels and is trained through Replaced Token Detection and Hyperspherical Separation Training.A [CLS] token is prepended to each input sequence.Source: §3.2 · p. 5

3.2.1 Replaced Token Detection (RTD).

  • RTD is a warmup task that classifies replaced versus non-replaced tokens before sequence-level anomaly detection.The discriminator uses a binary classification head for each input token except [CLS].Source: §3.2.1 · p. 5

3.2.2 Hyperspherical Separation Training (HST).

  • HST separates normal and pseudo-abnormal sequences by controlling the norm of the discriminator’s [CLS] feature embedding.Normal embeddings are pushed toward the origin, while anomalous embeddings are penalized for having small norms; λ balances the two terms.Source: §3.2.2 · p. 5

3.3 Overall Training

FastLogAD trains the generator and discriminator’s RTD task first, then trains HST to promote accurate anomaly scores. The staged schedule is intended to reduce unnecessary computation and prepare the discriminator for sequence-level recognition.

3.3 Overall Training

  • Training first combines MLM generation with RTD, or uses RTD alone for the random generator, then applies HST for anomaly scoring.The first stage lasts N epochs and the HST stage lasts M epochs.Source: §3.3 · p. 6
  • Joint MLM and RTD training reduces complexity because both tasks are auxiliary and are not used directly during detection.The paper contrasts joint training of these tasks with training them separately.Source: §3.3 · p. 6
  • RTD is completed before HST so the discriminator attends to crafted abnormal tokens before sequence-level learning, avoiding the risk of focusing on tokens instead of whole sequences.The paper notes that log anomalies are labeled at the sequence level in datasets such as HDFS.Source: §3.3 · p. 6

3.4 Detection

At detection time, FastLogAD scores each sequence using the discriminator’s [CLS] embedding norm and compares that score with a threshold.

3.4 Detection

  • A sequence is flagged abnormal when its discriminator [CLS] embedding norm exceeds a threshold set using a validation set of normal sequences.The generator is not needed for incoming sequences.Source: §3.4 · p. 6

4 EXPERIMENT

FastLogAD is evaluated on HDFS, BGL, and Thunderbird for detection performance and inference speed, with analyses of anomaly-score distributions and training ablations. The experiments report competitive F1-scores, fast inference using only the discriminator, and effects of RTD training and masking ratio.

4.1.1 Datasets. •

  • The evaluation uses HDFS blocks, BGL five-minute windows, and Thunderbird one-minute windows; chronological splits use about 5,000 initial sequences for training, with abnormal sequences reserved for testing.An additional BGL evaluation uses a 6:1:3 split; the authors could not directly compare GLAD because files were missing from its provided code.Source: §4.1.1 · p. 6, §4.2.3 · p. 7

4.1.3 Evaluation Metrics.

  • Precision, Recall, and F1-Score are the evaluation metrics; experiments use a Linux server with an Intel i9-9940X CPU, 64GB RAM, and an RTX 2080Ti GPU.The reported metrics use true-positive, false-positive, and false-negative counts.Source: §4.1.3 · p. 6, §4.1.4 · p. 6

4.1.4 Experimental Setup.

  • FastLogAD uses mask ratio r=0.5 and HST loss weight λ=1, with a threshold set at the validation embedding-norm 99% quantile; baseline thresholds are selected using test-set performance.The compared baselines are DeepLog, LogAnomaly, and LogBERT; their threshold selection requires abnormal sequences, giving them a natural performance-comparison advantage while being impractical.Source: §4.1.5 · p. 6, §4.1.2 · p. 6

4.2 Evaluation

  • FastLogAD-MLM achieves the best F1-Score across all three datasets; it exceeds DeepLog by 6.54% on HDFS and 4.29% on BGL, and LogBERT by 1.98% on Thunderbird.FastLogAD-Random ranks second overall, with a slight lag behind MLM on Thunderbird.Source: §4.2 · p. 7, Table 1 · p. 7

4.2.1 Inference Time Analysis.

  • FastLogAD has satisfactory inference speed across datasets and uses only the discriminator at inference, while sequence-length effects slow DeepLog and LogAnomaly on longer logs.LogBERT is slower on HDFS because it randomly masks and makes multiple predictions per sequence.Source: §4.2.1 · p. 7, Table 2 · p. 7

4.2.2 Distribution of Anomaly Score.

  • Normal anomaly scores cluster near the origin, while a significant portion of abnormal scores exceed 10, despite selecting the threshold without prior exposure to abnormal data.The distribution is reported for HDFS, BGL, and Thunderbird.Source: §4.2.2 · p. 7, Figure 5 · p. 8

4.3.1 RTD training.

  • RTD training slightly improves F1 performance for both generator variants across all three datasets, an enhancement attributed to supporting the subsequent HST task.Table 3 reports the with-RTD and without-RTD ablation.Source: §4.3.1 · pp. 7–8, Table 3 · p. 8

4.3.2 Masking ratio.

  • At masking ratio r=0, intact normal sequences become pseudo-anomalies and inflate normal embedding norms; performance drops at higher ratios, beginning at 0.7 on HDFS.On HDFS, high masking can make real hard anomalies more likely to be misclassified as normal, increasing false negatives and reducing recall.Source: §4.3.2 · p. 8, Figure 6 · p. 8

5 CONCLUSION AND FUTURE WORK

FastLogAD uses a generator-discriminator architecture trained on normal logs with pseudo-abnormal samples. The authors identify precision, training-data requirements, scalability, and adaptability as areas for future work.

5 CONCLUSION AND FUTURE WORK

  • FastLogAD trains a discriminator with pseudo-abnormal samples generated from labelled normal data.The paper describes this as enriching the training set to strengthen anomaly detection.Source: §5 · p. 8
  • Future work should explore scalability and adaptability across log formats for evolving data and real-time deployment environments.Source: §5 · p. 8
  • FastLogAD has comparatively lower precision because out-of-vocabulary test sequences encoded as [unk] are more likely to be classified as anomalies.The authors suggest semantic features and corresponding pseudo-anomaly features as directions for improving precision.Source: §5 · p. 8
  • FastLogAD currently requires fully normal training data; adapting it to pure unsupervised detection could remove that requirement and reduce manual-labelling costs.The authors describe this adaptation as a future extension that could broaden applicability.Source: §5 · p. 9

A ADDITIONAL EXPERIMENT

The additional experiment uses a 6:1:3 split on BGL and reports evaluation scores alongside computational overhead.

A ADDITIONAL EXPERIMENT

A.1 Evaluation Performance

On the additional BGL evaluation, FastLogAD-MLM leads in F1-Score, while both FastLogAD variants have superior overall AUC and AUPR scores.

A.1 Evaluation Performance

  • 1% advantage over GLAD [11] in F1-Score: FastLogAD-MLM achieves the best score under the additional BGL setting.Source: Table 4 · p. 10, §A.1 · p. 10
  • Over 10% advantage over the best baseline in AUPR: both FastLogAD variants have superior overall AUC and AUPR scores.The passage describes this AUPR result as strong performance on an imbalanced log dataset.Source: Table 4 · p. 10, §A.1 · p. 10
  • The best score under each metric is bolded in Table 4.Source: Table 4 · p. 10

Related papers

Loading 2404.08750v1…