{"type":"ScholarlyArticle","title":"LogAnomaly: Unsupervised Detection of Sequential and Quantitative Anomalies in Unstructured Logs","authors":[{"name":"Weibin Meng","slug":"weibin-meng","given":"Weibin","family":"Meng","affiliation":"Tsinghua University; Beijing National Research Center for Information Science and Technology (BNRist)"},{"name":"Ying Liu","slug":"ying-liu","given":"Ying","family":"Liu","affiliation":"Tsinghua University; Beijing National Research Center for Information Science and Technology (BNRist)"},{"name":"Yichen Zhu","slug":"yichen-zhu","given":"Yichen","family":"Zhu","affiliation":"University of Toronto"},{"name":"Shenglin Zhang","slug":"shenglin-zhang","given":"Shenglin","family":"Zhang","affiliation":"Nankai University"},{"name":"Dan Pei","slug":"dan-pei","given":"Dan","family":"Pei","affiliation":"Tsinghua University; Beijing National Research Center for Information Science and Technology (BNRist)"},{"name":"Yuqing Liu","slug":"yuqing-liu","given":"Yuqing","family":"Liu","affiliation":"Nankai University"},{"name":"Yihao Chen","slug":"yihao-chen","given":"Yihao","family":"Chen","affiliation":"Tsinghua University; Beijing National Research Center for Information Science and Technology (BNRist)"},{"name":"Ruizhi Zhang","slug":"ruizhi-zhang","given":"Ruizhi","family":"Zhang","affiliation":"Huawei"},{"name":"Shimin Tao","slug":"shimin-tao","given":"Shimin","family":"Tao","affiliation":"Huawei"},{"name":"Pei Sun","slug":"pei-sun","given":"Pei","family":"Sun","affiliation":"Huawei"},{"name":"Rong Zhou","slug":"rong-zhou","given":"Rong","family":"Zhou","affiliation":"Huawei"}],"abstract":"Recording runtime status via logs is common for almost every computer system, and detecting anomalies in logs is crucial for timely identifying malfunctions of systems. However, manually detecting anomalies for logs is time-consuming, error-prone, and infeasible. Existing automatic log anomaly detection approaches, using indexes rather than semantics of log templates, tend to cause false alarms. In this work, we propose LogAnomaly, a framework to model unstructured a log stream as a natural language sequence. Empowered by template2vec, a novel, simple yet effective method to extract the semantic information hidden in log templates, LogAnomaly can detect both sequential and quantitive log anomalies simultaneously, which were not done by any previous work. Moreover, LogAnomaly can avoid the false alarms caused by the newly appearing log templates between periodic model retrainings. Our evaluation on two public production log datasets show that LogAnomaly outperforms existing log-based anomaly detection methods.","doi":"10.24963/ijcai.2019/658","url":"https://ijcai.org/proceedings/2019/658","pdf":"https://ijcai.org/proceedings/2019/0658.pdf","markdown":"https://ijcai.org/proceedings/2019/658.md","bibtex":"https://ijcai.org/proceedings/2019/bibtex/658","volume":{"slug":"2019","title":"Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2019","url":"https://ijcai.org/proceedings/2019/","year":2019,"location":"Macao","dates":"10-16 August 2019","editors":"Sarit Kraus","isbn":"978-0-9992411-4-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2019"},"section":"Multidisciplinary Topics and Applications","track":"Main track","number":658,"pages":{"first":4739,"last":4745},"keywords":["Multidisciplinary Topics and Applications: Real-Time Systems","Machine Learning Applications: Other Applications","Machine Learning Applications: Applications of Unsupervised Learning"],"videos":[],"references":[{"position":1,"raw":"[Bu et al., 2018] Jiahao Bu, Ying Liu, Shenglin Zhang, Weibin Meng, Qitong Liu, Xiaotian Zhu, and Dan Pei. Rapid deployment of anomaly detection models for large number of emerging kpi streams. In IEEE IPCCC, 2018.","title":"Rapid deployment of anomaly detection models for large number of emerging kpi streams","authors":"Jiahao Bu, Ying Liu, Shenglin Zhang, Weibin Meng, Qitong Liu, Xiaotian Zhu, Dan Pei","year":"2018","venue":"IEEE IPCCC","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Du et al., 2017] Min Du, Feifei Li, Guineng Zheng, and Vivek Srikumar. Deeplog: Anomaly detection and diag- nosis from system logs through deep learning. In Proceed- ings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pages 1285-1298. ACM, 2017.","title":"Deeplog: Anomaly detection and diagnosis from system logs through deep learning","authors":"Du","year":"2017","venue":"Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[He et al., 2016] Shilin He, Jieming Zhu, Pinjia He, and Michael R Lyu. Experience report: System log analysis for anomaly detection. In 2016 IEEE 27th International Symposium on Software Reliability Engineering (ISSRE), pages 207-218. IEEE, 2016.","title":"Experience report: System log analysis for anomaly detection","authors":"He","year":"2016","venue":"IEEE 27th International Symposium on Software Reliability Engineering (ISSRE)","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[He et al., 2018] Shilin He, Qingwei Lin, Jian-Guang Lou, Hongyu Zhang, Michael R Lyu, and Dongmei Zhang. Identifying impactful service system problems via log analysis. In ESEC/FSE, pages 60-70. ACM, 2018.","title":"Identifying impactful service system problems via log analysis","authors":"Shilin He, Qingwei Lin, Jian-Guang Lou, Hongyu Zhang, Dongmei Michael R Lyu, Zhang","year":"2018","venue":"ESEC/FSE","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Khatuya et al., 2018] Subhendu Khatuya, Niloy Ganguly, Jayanta Basak, Madhumita Bharde, and Bivas Mitra. Adele: Anomaly detection from event log empiricism. IEEE INFOCOM 2018 -IEEE Conference on Computer Communications, pages 2114-2122, 2018.","title":"Adele: Anomaly detection from event log empiricism","authors":"Subhendu Khatuya, Niloy Ganguly, Jayanta Basak, Madhumita Bharde, Bivas Mitra","year":"2018","venue":"IEEE INFOCOM 2018 -IEEE Conference on Computer Communications","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Liang et al., 2007] Yinglung Liang, Yanyong Zhang, Hui Xiong, and Ramendra Sahoo. Failure prediction in ibm bluegene/l event logs. In Data Mining, ICDM 2007, pages 583-588. IEEE, 2007.","title":"Failure prediction in ibm bluegene/l event logs","authors":"Yinglung Liang, Yanyong Zhang, Hui Xiong, Ramendra Sahoo","year":"2007","venue":"Data Mining, ICDM 2007","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Lin et al., 2016] Qingwei Lin, Hongyu Zhang, Jian-Guang Lou, Yu Zhang, and Xuewei Chen. Log clustering based problem identification for online service systems. In Pro- ceedings of the 38th International Conference on Software Engineering Companion, pages 102-111. ACM, 2016.","title":"Log clustering based problem identification for online service systems","authors":"Qingwei Lin, Hongyu Zhang, Jian-Guang Lou, Yu Zhang, Xuewei Chen","year":"2016","venue":"Proceedings of the 38th International Conference on Software Engineering Companion","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Lou et al., 2010] Jian-Guang Lou, Qiang Fu, Shengqi Yang, Ye Xu, and Jiang Li. Mining invariants from console logs for system problem detection. In USENIX Annual Techni- cal Conference, pages 23-25, 2010.","title":"Mining invariants from console logs for system problem detection","authors":"Jian-Guang Lou, Qiang Fu, Shengqi Yang, Ye Xu, Jiang Li","year":"2010","venue":"USENIX Annual Technical Conference","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Ma et al., 2018] Minghua Ma, Shenglin Zhang, Dan Pei, Xin Huang, and Hongwei Dai. Robust and rapid adaption for concept drift in software system anomaly detection. In 2018 IEEE 29th International Symposium on Software Re- liability Engineering (ISSRE), pages 13-24. IEEE, 2018.","title":"Robust and rapid adaption for concept drift in software system anomaly detection","authors":"Minghua Ma, Shenglin Zhang, Dan Pei, Xin Huang, Hongwei Dai","year":"2018","venue":"IEEE 29th International Symposium on Software Reliability Engineering (ISSRE)","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Meng et al., 2018] Weibin Meng, Ying Liu, Shenglin Zhang, Dan Pei, Hui Dong, Lei Song, and Xulong Luo. Device-agnostic log anomaly classification with partial la- bels. In 2018 IEEE/ACM 26th International Symposium on Quality of Service (IWQoS), pages 1-6. IEEE, 2018.","title":"Device-agnostic log anomaly classification with partial labels","authors":"Weibin Meng, Ying Liu, Shenglin Zhang, Dan Pei, Hui Dong, Lei Song, Xulong Luo","year":"2018","venue":"IEEE/ACM 26th International Symposium on Quality of Service (IWQoS)","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Messaoudi et al., 2018] Salma Messaoudi, Annibale Panichella, and Domenico Bianculli. A search-based approach for accurate identification of log message for- mats. In Proceedings of the 26th IEEE/ACM International Conference on Program Comprehension. ACM, 2018.","title":"A search-based approach for accurate identification of log message formats","authors":"Messaoudi","year":"2018","venue":"Proceedings of the 26th IEEE/ACM International Conference on Program Comprehension","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Mikolov et al., 2013] Tomas Mikolov, Kai Chen, Greg Corrado, and Jeffrey Dean. Efficient estimation of word representations in vector space. arXiv preprint arXiv:1301.3781, 2013.","title":"Efficient estimation of word representations in vector space","authors":"Tomas Mikolov, Kai Chen, Greg Corrado, Jeffrey Dean","year":"2013","venue":null,"doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Miller, 1995] George A Miller. Wordnet: a lexical database for english. Communications of the ACM, 38(11):39-41, 1995.","title":"Wordnet: a lexical database for english","authors":"George A Miller","year":"1995","venue":"Communications of the ACM","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Nandi et al., 2016] Animesh Nandi, Atri Mandal, Shubham Atreja, Gargi B Dasgupta, and Subhrajit Bhattacharya. Anomaly detection using program control flow graph min- ing from execution logs. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discov- ery and Data Mining, pages 215-224. ACM, 2016.","title":"Anomaly detection using program control flow graph mining from execution logs","authors":"Animesh Nandi, Atri Mandal, Shubham Atreja, B Gargi, Subhrajit Dasgupta, Bhattacharya","year":"2016","venue":"Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Nguyen et al., 2016] Kim Anh Nguyen, Sabine Schulte im Walde, and Ngoc Thang Vu. Integrating distributional lex- ical contrast into word embeddings for antonym-synonym distinction. arXiv preprint arXiv:1605.07766, 2016.","title":"Integrating distributional lexical contrast into word embeddings for antonym-synonym distinction","authors":"Anh Kim, Sabine Nguyen, Ngoc Thang Schulte Im Walde, Vu","year":"2016","venue":null,"doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Oliner and Stearley, 2007] Adam J. Oliner and Jon Stearley. What supercomputers say: A study of five system logs. IEEE International Conference on Dependable Systems and Networks (DSN'07), pages 575-584, 2007.","title":"What supercomputers say: A study of five system logs","authors":"Adam J Oliner, Jon Stearley","year":"2007","venue":"IEEE International Conference on Dependable Systems and Networks (DSN'07)","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Satpathi et al., 2018] Siddhartha Satpathi, Supratim Deb, R Srikant, and He Yan. Learning latent events from net- work message logs: A decomposition based approach. arXiv preprint arXiv:1804.03346, 2018.","title":"Learning latent events from network message logs: A decomposition based approach","authors":"Siddhartha Satpathi, Supratim Deb, R Srikant, He Yan","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Xu et al., 2009] Wei Xu, Ling Huang, Armando Fox, David Patterson, and Michael Jordan. Largescale system prob- lem detection by mining console logs. Proceedings of SOSP'09, 2009.","title":"Largescale system problem detection by mining console logs","authors":"Wei Xu, Ling Huang, Armando Fox, David Patterson, Michael Jordan","year":"2009","venue":"Proceedings of SOSP'09","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Zhang et al., 2015] Shenglin Zhang, Ying Liu, Dan Pei, Yu Chen, Xianping Qu, Shimin Tao, and Zhi Zang. Rapid and robust impact assessment of software changes in large internet-based services. In International Conference on emerging Networking EXperiments and Technologies (CoNEXT), pages 1-13, 2015.","title":"Rapid and robust impact assessment of software changes in large internet-based services","authors":"Shenglin Zhang, Ying Liu, Dan Pei, Yu Chen, Xianping Qu, Shimin Tao, Zhi Zang","year":"2015","venue":"International Conference on emerging Networking EXperiments and Technologies (CoNEXT)","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Zhang et al., 2016] Ke Zhang, Jianwu Xu, Martin Renqiang Min, Guofei Jiang, Konstantinos Pelechrinis, and Hui Zhang. Automated it system failure prediction: A deep learning approach. In 2016 IEEE International Conference on Big Data (Big Data), pages 1291-1300. IEEE, 2016.","title":"Automated it system failure prediction: A deep learning approach","authors":"Ke Zhang, Jianwu Xu, Martin Renqiang Min, Guofei Jiang, Konstantinos Pelechrinis, Hui Zhang","year":"2016","venue":"2016 IEEE International Conference on Big Data (Big Data)","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Zhang et al., 2017] Shenglin Zhang, Weibin Meng, Jiahao Bu, Sen Yang, Ying Liu, Dan Pei, Jun Xu, Yu Chen, Hui Dong, Xianping Qu, et al. Syslog processing for switch failure diagnosis and prediction in datacenter networks. In 2017 IEEE/ACM 25th International Symposium on Qual- ity of Service (IWQoS), pages 1-10. IEEE, 2017.","title":"Syslog processing for switch failure diagnosis and prediction in datacenter networks","authors":"Shenglin Zhang, Weibin Meng, Jiahao Bu, Sen Yang, Ying Liu, Dan Pei, Jun Xu, Yu Chen, Hui Dong, Xianping Qu","year":"2017","venue":"IEEE/ACM 25th International Symposium on Quality of Service (IWQoS)","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Zhang et al., 2018a] Shenglin Zhang, Ying Liu, Weibin Meng, Zhiling Luo, Jiahao Bu, Sen Yang, Peixian Liang, Dan Pei, Jun Xu, Yuzhi Zhang, et al. Prefix: Switch fail- ure prediction in datacenter networks. Proceedings of the ACM on Measurement and Analysis of Computing Sys- tems, 2(1):2, 2018.","title":"Prefix: Switch failure prediction in datacenter networks","authors":"Zhang","year":"2018","venue":"Proceedings of the ACM on Measurement and Analysis of Computing Systems","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Zhang et al., 2018b] Shenglin Zhang, Ying Liu, Dan Pei, Yu Chen, Xianping Qu, Shimin Tao, Zhi Zang, Xiaowei Jing, and Mei Feng. Funnel: Assessing software changes in web-based services. IEEE Transactions on Services Computing, 11(1):34-48, 2018.","title":"Funnel: Assessing software changes in web-based services","authors":"Zhang","year":"2018","venue":"IEEE Transactions on Services Computing","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}