GLAD: Content-aware Dynamic Graphs For Log Anomaly Detection

by   Yufei Li, et al.

Logs play a crucial role in system monitoring and debugging by recording valuable system information, including events and states. Although various methods have been proposed to detect anomalies in log sequences, they often overlook the significance of considering relations among system components, such as services and users, which can be identified from log contents. Understanding these relations is vital for detecting anomalies and their underlying causes. To address this issue, we introduce GLAD, a Graph-based Log Anomaly Detection framework designed to detect relational anomalies in system logs. GLAD incorporates log semantics, relational patterns, and sequential patterns into a unified framework for anomaly detection. Specifically, GLAD first introduces a field extraction module that utilizes prompt-based few-shot learning to identify essential fields from log contents. Then GLAD constructs dynamic log graphs for sliding windows by interconnecting extracted fields and log events parsed from the log parser. These graphs represent events and fields as nodes and their relations as edges. Subsequently, GLAD utilizes a temporal-attentive graph edge anomaly detection model for identifying anomalous relations in these dynamic log graphs. This model employs a Graph Neural Network (GNN)-based encoder enhanced with transformers to capture content, structural and temporal features. We evaluate our proposed method on three datasets, and the results demonstrate the effectiveness of GLAD in detecting anomalies indicated by varying relational patterns.


LogGD:Detecting Anomalies from System Logs by Graph Neural Networks

Log analysis is one of the main techniques engineers use to troubleshoot...

LogBERT: Log Anomaly Detection via BERT

Detecting anomalous events in online computer systems is crucial to prot...

CSCLog: A Component Subsequence Correlation-Aware Log Anomaly Detection Method

Anomaly detection based on system logs plays an important role in intell...

Temporal Graphs Anomaly Emergence Detection: Benchmarking For Social Media Interactions

Temporal graphs have become an essential tool for analyzing complex dyna...

LogDP: Combining Dependency and Proximity for Log-based Anomaly Detection

Log analysis is an important technique that engineers use for troublesho...

ADSAGE: Anomaly Detection in Sequences of Attributed Graph Edges applied to insider threat detection at fine-grained level

Previous works on the CERT insider threat detection case have neglected ...

Anomalous Situation Detection in Complex Scenes

In this paper we investigate a robust method to identify anomalies in co...

Please sign up or login with your details

Forgot password? Click here to reset