Impact of log parsing on deep learning-based anomaly detection.

Area of Science:

• Computer Science
• Software Engineering
• Machine Learning

Background:

• Software systems generate vast logs crucial for runtime information and anomaly detection.
• Log parsing is a common preprocessing step in deep learning-based anomaly detection, but its impact on accuracy is understudied.

Purpose of the Study:

• To empirically investigate the impact of log parsing techniques on anomaly detection accuracy.
• To identify key properties of log parsing that enhance anomaly detection performance.

Main Methods:

• Evaluated 13 log parsing techniques and 7 anomaly detection techniques (5 deep learning, 2 traditional ML) on 3 public log datasets.
• Assessed the correlation between log parsing accuracy and anomaly detection accuracy using various metrics.

Main Results:

• No strong correlation was found between log parsing accuracy and anomaly detection accuracy.
• Log parsing results' distinguishability, rather than accuracy, significantly impacts anomaly detection performance.

Conclusions:

• The effectiveness of log parsing for anomaly detection relies on the distinguishability of parsed logs, not solely on parsing accuracy.
• Future research should focus on developing log parsing methods that enhance the distinguishability of log events for improved anomaly detection.