Improving log-based anomaly detection through learned adaptive filter
Yiyuan Xiong, Shaofeng Cai
TL;DR
The paper addresses the limitation of fixed top $k$ thresholds in next log event based anomaly detection by proposing a learned adaptive filter driven by deep reinforcement learning. It formulates the problem as a Markov Decision Process and implements a PPO based DRL solution within Ray RLlib to select per sequence filter values that maximize anomaly detection performance when combined with state of the art unsupervised models such as DeepLog and LogAnomaly. Experiments on two real world datasets, HDFS and BGL, demonstrate that the adaptive filter consistently improves F1 scores and robustness, particularly in scenarios with limited labeled data and for datasets with many unique log events. The approach is designed to be orthogonal to existing models, enabling practical integration into existing log based anomaly detection pipelines and offering scalable training via distributed RL. The work also discusses interpretability via analysis of learned action distributions and outlines future work including end to end RL pipelines and extensions to other domains.
Abstract
Log messages record important system runtime information and are useful for detecting anomalous behaviors and managing modern software systems. Many supervised and unsupervised learning methods have been proposed recently for log-based anomaly detection. State-of-the-art unsupervised methods predict the next log event given a log sequence and apply fixed configurations that use the same filter condition (i.e. k, the top k predicted log events will be regarded as normal next events) which leads to inferior performance in the detection stage because it sets one fixed k for all log sequences, which ignores the dynamic nature and variance in different log sequences. Recently, deep reinforcement learning (DRL) are widely applied to make intelligent decisions in a dynamic environment. In this work, we contend that it is necessary to apply adaptive filters for different log sequences. To achieve this, we propose a novel approach based on DRL to construct a learned adaptive filter and apply different normal/abnormal filter thresholds for different log sequences. We define the Markov Decision Process (MDP) and formulate the learned adaptive filter as a problem that can be solved by DRL. We evaluate the learned adaptive filter on two state-of-the-art log-based anomaly detection unsupervised approaches DeepLog and LogAnomaly in two datasets HDFS and BGL. Extensive experiments show that our approach outperforms the fixed configurations and achieves significantly better performance in log-based anomaly detection.