DualAttlog: Context aware dual attention networks for log-based anomaly detection.

Area of Science:

• Computer Science
• Artificial Intelligence
• Machine Learning

Background:

• Existing log-driven anomaly detection methods often fail due to the assumption of static log data.
• Dynamic and evolving log data presents a significant challenge for traditional anomaly detection systems.

Purpose of the Study:

• To propose a novel log anomaly detection model, DualAttlog, capable of handling dynamic log data.
• To enhance the accuracy and robustness of anomaly detection in log sequences.

Main Methods:

• Developed DualAttlog, a model incorporating word-level and sequence-level semantic encoding modules.
• Utilized a self-matching attention mechanism for word-level encoding to capture local semantic interactions.
• Employed a pre-trained model for sequence-level encoding to extract global semantic information.
• Integrated both levels of encoding using a context-aware dual attention module to reduce redundancy and improve detection.

Main Results:

• DualAttlog achieved an F1-Score exceeding 95% across 7 public datasets.
• Demonstrated strong performance on real-world industrial datasets, with F1-Scores of 82.35% (Real-Industrial W) and 83.54% (Real-Industrial Q).
• Outperformed existing baseline techniques on 9 diverse datasets, highlighting its significant advantages.

Conclusions:

• DualAttlog effectively addresses the limitations of static log assumptions in anomaly detection.
• The model's dual attention mechanism and hierarchical semantic encoding significantly enhance detection accuracy.
• DualAttlog represents a substantial advancement in log-based anomaly detection, particularly for dynamic environments.