对基于日志的异常检测机器学习技术的全面研究
Shan Ali1, Chaima Boufaied2, Domenico Bianculli3
1University of Ottawa, Ottawa, Canada.
Empirical software engineering
|June 26, 2025
概括
传统和深度机器学习 (ML) 方法在基于日志的异常检测 (LAD) 中表现相似. 传统的ML技术对超参数调整的敏感性比深度学习方法要小.
科学领域:
- 计算机科学 计算机科学
- 人工智能的人工智能
- 软件工程 软件工程 软件工程
背景情况:
- 系统复杂性需要自动日志分析技术,如基于日志的异常检测 (LAD).
- 深度学习方法主导着LAD研究,但传统和半监督方法也值得考虑.
- 目前对LAD技术的评估主要集中在检测准确度上,忽视了关键的实际方面.
研究的目的:
- 进行一项全面的实证研究,比较各种监督和半监督,传统和深度ML技术用于LAD.
- 根据检测准确度,时间性能和对超参数调整的灵敏度来评估LAD技术.
- 提供关于不同ML方法对LAD的相对优点和弱点的强有力的证据.
主要方法:
- 对广泛的监督和半监督,传统和深度ML技术进行评估.
- 根据四个标准进行评估:检测准确度,训练时间,预测时间和对超参数调整的灵敏度.
- 使用与LAD相关的基准数据集进行实证比较.
主要成果:
- 监督的传统和深度ML技术在大多数基准数据集上表现出可比的检测精度和预测时间.
- 与深度学习方法相比,传统的ML技术对超参数调整的敏感性较低.
- 半监督技术通常比监督方法的检测准确度要低得多.
结论:
- 传统的和深度监督的ML技术对LAD都是可行的,传统方法提供了更好的超参数稳定性.
- 在选择LAD技术时,不仅要考虑准确性,还要考虑计算性能和对调整的敏感性.
- 进一步的研究应该探索这些发现对系统工程师的实际影响.
相关概念视频
01:18Steps in Outbreak Investigation
215
In the ever-evolving field of public health, statistical analysis serves as a cornerstone for understanding and managing disease outbreaks. By leveraging various statistical tools, health professionals can predict potential outbreaks, analyze ongoing situations, and devise effective responses to mitigate impact. For that to happen, there are a few possible stages of the analysis:
215
01:02Quantifying and Rejecting Outliers: The Grubbs Test
2.2K
Sometimes, a data set can have a recorded numerical observation that greatly deviates from the rest of the data. Assuming that the data is normally distributed, a statistical method called the Grubbs test can be used to determine whether the observation is truly an outlier. To perform a two-tailed Grubbs test, first, calculate the absolute difference between the outlier and the mean. Then, calculate the ratio between this difference and the standard deviation of the sample. This...
2.2K
01:29Mechanistic Models: Compartment Models in Algorithms for Numerical Problem Solving
103
Mechanistic models play a crucial role in algorithms for numerical problem-solving, particularly in nonlinear mixed effects modeling (NMEM). These models aim to minimize specific objective functions by evaluating various parameter estimates, leading to the development of systematic algorithms. In some cases, linearization techniques approximate the model using linear equations.
In individual population analyses, different algorithms are employed, such as Cauchy's method, which uses a...
In individual population analyses, different algorithms are employed, such as Cauchy's method, which uses a...
103