Graph Neural Network based Log Anomaly Detection and Explanation

by   Zhong Li, et al.

Event logs are widely used to record the status of high-tech systems, making log anomaly detection important for monitoring those systems. Most existing log anomaly detection methods take a log event count matrix or log event sequences as input, exploiting quantitative and/or sequential relationships between log events to detect anomalies. Unfortunately, only considering quantitative or sequential relationships may result in many false positives and/or false negatives. To alleviate this problem, we propose a graph-based method for unsupervised log anomaly detection, dubbed Logs2Graphs, which first converts event logs into attributed, directed, and weighted graphs, and then leverages graph neural networks to perform graph-level anomaly detection. Specifically, we introduce One-Class Digraph Inception Convolutional Networks, abbreviated as OCDiGCN, a novel graph neural network model for detecting graph-level anomalies in a collection of attributed, directed, and weighted graphs. By coupling the graph representation and anomaly detection steps, OCDiGCN can learn a representation that is especially suited for anomaly detection, resulting in a high detection accuracy. Importantly, for each identified anomaly, we additionally provide a small subset of nodes that play a crucial role in OCDiGCN's prediction as explanations, which can offer valuable cues for subsequent root cause diagnosis. Experiments on five benchmark datasets show that Logs2Graphs performs at least on par state-of-the-art log anomaly detection methods on simple datasets while largely outperforming state-of-the-art log anomaly detection methods on complicated datasets.


page 1

page 2

page 3

page 4


LogGD:Detecting Anomalies from System Logs by Graph Neural Networks

Log analysis is one of the main techniques engineers use to troubleshoot...

Feature Selection for Fault Detection and Prediction based on Event Log Analysis

Event logs are widely used for anomaly detection and prediction in compl...

Detecting Log Anomalies with Multi-Head Attention (LAMA)

Anomaly detection is a crucial and challenging subject that has been stu...

OCGNN: One-class Classification with Graph Neural Networks

Nowadays, graph-structured data are increasingly used to model complex s...

Graph Convolutional Networks for traffic anomaly

Event detection has been an important task in transportation, whose task...

A Theoretical Investigation of Graph Degree as an Unsupervised Normality Measure

For a graph representation of a dataset, a straightforward normality mea...

Pattern Mining for Anomaly Detection in Graphs: Application to Fraud in Public Procurement

In the context of public procurement, several indicators called red flag...

Please sign up or login with your details

Forgot password? Click here to reset