CoChat
Sign Up
Cited by 49

The DOI matches its Crossref record; 12 of the 12 references it cites were found in a registry or an index.

Log Sequence Anomaly Detection Based on Local Information Extraction and Globally Sparse Transformer Model

Zhang, Chunkai, Wang, Xinyu, Zhang, Hongye, Zhang, Hanyu, Han, Peiyi·2021·IEEE Transactions on Network and Service Management
DOI 10.1109/tnsm.2021.3125967
Open this paper in CoChat — free account

Abstract

Anomaly detection for log sequences is a necessary task for system intelligent operation and fault diagnosis. In a log sequence, adjacent logs have the property of local correlation, while long-distance logs have remote dependencies. It is helpful to fully mine these information during modeling for improving the performance of anomaly detection. Meanwhile, there are some redundant information or noise in the log sequence, which has no contribution to the detection, and may even bring negative impact. The existing methods for log sequence anomaly detection do not take the above problems into account when constructing models. In this paper, we propose LSADNET, an unsupervised log sequence anomaly detection network based on local information extraction and globally sparse Transformer model. LSADNET applies multi-layer convolution to capture the local correlation between adjacent logs, and utilizes Transformer to learn the global dependency among long-distance logs. Meanwhile, we propose a globally sparse Transformer model to improve the self-attention mechanism, which can help to retain important information adaptively and eliminate the irrelevant information in the log sequence. In addition, according to the co-occurrence mode of log templates, we put forward the calculation formula of log template transfer value, and apply it to log vectorization. Through sufficient experiments on two public datasets, it is confirmed that LSADNET has better performance than the state-of-art me…

Overview

Integrity signals

Registry

Crossref · 10.1109/tnsm.2021.3125967

Cites

12 of 12 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Verification

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Citations

Cites

Research works printed but not linked: 33

  1. zaheer, 2020, Big bird: Transformers for longer sequences, arXiv 2007 14062
  2. zhang, 2017, Syslog processing for switch failure diagnosis and prediction in datacenter networks, Proc IEEE/ACM 25th Int Symp Qual Service (IWQoS), 1
  3. 10.3390/s20092451 · DOI
  4. 10.1109/ICCCN49398.2020.9209707 · DOI
  5. li, 2019, Enhancing the locality and breaking the memory bottleneck of transformer on time series forecasting, Advances in neural information processing systems, 32, 5243
  6. 10.1109/ACCESS.2019.2953981 · DOI
  7. 10.1145/3338906.3338931 · DOI · Paper page
  8. 10.1109/TNSM.2020.3034647 · DOI
  9. 10.1145/1629575.1629587 · DOI · Paper page
  10. lou, 2010, Mining invariants from console logs for system problem detection, Proc USENIXATC, 24
  11. lin, 2016, Log Clustering Based Problem Identification for Online Service Systems, 2016 IEEE/ACM 38th International Conference on Software Engineering Companion (ICSE-C) ICSE-C, 102
  12. grover, 2018, Anomaly detection for application log data, 10.31979/etd.znsb-bw4d · DOI
  13. 10.1145/3133956.3134015 · DOI · Paper page
  14. 10.24963/ijcai.2019/658 · DOI · Paper page
  15. 10.1109/ICRITO48877.2020.9197818 · DOI
  16. chalapathy, 2019, Deep learning for anomaly detection: A survey, arXiv 1901 03407
  17. 10.1016/j.cose.2020.101739 · DOI
  18. bursic, 2019, Anomaly detection from log files using unsupervised deep learning, Proc Int Symp Formal Methods, 200
  19. 10.1109/CCWC.2019.8666450 · DOI
  20. 10.1109/ISSRE.2016.21 · DOI
  21. 10.1109/DASC/PiCom/DataCom/CyberSciTec.2018.00037 · DOI
  22. 10.1145/2523649.2523670 · DOI
  23. vaswani, 2017, Attention is all you need, Proc 31st Int Conf Neural Inf Process Syst, 5998
  24. 10.1109/DSN.2007.103 · DOI
  25. 10.1109/ICDM.2009.60 · DOI
  26. 10.1145/1557019.1557154 · DOI
  27. luong, 2014, Addressing the rare word problem in neural machine translation, arXiv 1410 8206
  28. 10.1145/2063576.2063690 · DOI · Paper page
  29. 10.1145/360825.360861 · DOI
  30. 10.1007/BF00344251 · DOI · Paper page
  31. 10.1109/ICDM.2016.0103 · DOI · Paper page
  32. zhang, 2017, Syslog processing for switch failure diagnosis and prediction in datacenter networks, Proc IEEE/ACM 25th Int Symp Qual Service (IWQoS), 1
  33. mikolov, 2013, Efficient estimation of word representations in vector space, arXiv 1301 3781 [cs]

Cited by

Sorted by citations

See all 49

Metadata

Authors
Zhang, C., Wang, X., Zhang, H., Zhang, H., & Han, P.
Venue
IEEE Transactions on Network and Service Management
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Published
2021-12
Volume
18
Issue
4
Pages
4119-4133
ISSN
  • 1932-4537
  • 2373-7379
DOI
10.1109/tnsm.2021.3125967
Cited by
49
References
12
Licence
Funders
Natural Science Foundation of Guangdong Province, China and Shenzhen Research Council (2020A1515010970, JCYJ20200109113427092, GJHZ20180928155209705)

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review