SSADLog: Whole Lifecycle Tuning Anomaly Detection with Small Sample Logs

SSADLog: Whole Lifecycle Tuning Anomaly Detection with Small Sample Logs | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article SSADLog: Whole Lifecycle Tuning Anomaly Detection with Small Sample Logs Zhisheng Zhou, Meixiu Zhou, Axin Wu, Jie Xia, Weiping Liu This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-3588406/v2 This work is licensed under a CC BY 4.0 License Status: Posted Version 2 posted You are reading this latest preprint version Show more versions Abstract Log messages play a critical role in system analysis and issue resolution, particularly in complex software-intensive systems that demand high availability and quality assurance. However, log-based anomaly detection faces three major challenges. Firstly, millions of log data poses a significant labeling challenge. Secondly, log data tends to exhibit a severe class imbalance. Thirdly, the task of anomaly detection in such massive datasets requires both high accuracy and efficiency. Numerous deep learning based methods have been proposed to tackle those challenges. Yet, a comprehensive solution that effectively addresses all these issues has remained elusive. After meticulously analyzing log messages from some stable systems, we have observed a common trend: the number of unique anomaly logs is consistently small. Based on this observation, we present a novel framework called ''Whole Lifecycle Tuning Anomaly Detection with Small Sample Logs'' (SSADLog). SSADLog introduces a hyper-efficient log data pre-processing method that generates a representative subset of small sample logs. It leverages a pre-trained bidirectional encoder representations from transformers (BERT) language model to create contextual word embeddings. Furthermore, a semi-supervised fine-tuning process is employed for enhancing detection accuracy. SSADLog distinguishes itself with its capability to achieve high-performance iterations by fine-tuning language models with small size log samples. Extensive experimental evaluations show that SSADLog greatly reduces the effort to detect anomaly log messages from millions of daily new logs and outperforms the previous representative methods across various log datasets in terms of precision, recall, and F1 score. Anomaly detection small samples whole lifecycle tuning log messages language model Full Text Additional Declarations The authors declare no competing interests. Cite Share Download PDF Status: Posted Version 2 posted You are reading this latest preprint version Show more versions Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-3588406","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":249007688,"identity":"2b735026-1015-473a-9dca-d058e632da05","order_by":0,"name":"Zhisheng Zhou","email":"","orcid":"","institution":"Jinan University","correspondingAuthor":false,"prefix":"","firstName":"Zhisheng","middleName":"","lastName":"Zhou","suffix":""},{"id":249007689,"identity":"f31cc794-833c-46c9-8052-6c4cab344085","order_by":1,"name":"Meixiu Zhou","email":"","orcid":"","institution":"Jinan University","correspondingAuthor":false,"prefix":"","firstName":"Meixiu","middleName":"","lastName":"Zhou","suffix":""},{"id":249007690,"identity":"162efbc2-3a41-4011-8954-6dc0be15ff21","order_by":2,"name":"Axin Wu","email":"","orcid":"","institution":"Jinan University","correspondingAuthor":false,"prefix":"","firstName":"Axin","middleName":"","lastName":"Wu","suffix":""},{"id":249007691,"identity":"f84f43ba-c643-47e3-a5f7-77fe94d9ca2d","order_by":3,"name":"Jie Xia","email":"","orcid":"","institution":"WangAnxin Technology Co. LTD.","correspondingAuthor":false,"prefix":"","firstName":"Jie","middleName":"","lastName":"Xia","suffix":""},{"id":249007692,"identity":"dcd67737-ec35-4338-b092-23763ad2905c","order_by":4,"name":"Weiping Liu","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAAp0lEQVRIiWNgGAWjYFAC5sYHEmBGAtFaGJsNSNbSBtFBtBaD241tFZY7DjPws+cYMPzcQYyWOwfbbkieOcwg2fPGgLH3DBFazG4kArW0HWYwuJFjwMzYRqSWApAWe5K0MIBtkSBWi/2dg80Skm3pPBJnnhUc7CVGi+Ts5oOfJdus5fjbkzc++EmMFgZgpDADMQ+IfYAYDWAtjB+IUzoKRsEoGAUjFQAASjo1SBNTa48AAAAASUVORK5CYII=","orcid":"","institution":"Jinan University","correspondingAuthor":true,"prefix":"","firstName":"Weiping","middleName":"","lastName":"Liu","suffix":""}],"badges":[],"createdAt":"2023-11-10 04:29:11","currentVersionCode":2,"declarations":{"humanSubjects":false,"vertebrateSubjects":false,"conflictsOfInterestStatement":false,"humanSubjectEthicalGuidelines":false,"humanSubjectConsent":false,"humanSubjectClinicalTrial":false,"humanSubjectCaseReport":false,"vertebrateSubjectEthicalGuidelines":false},"doi":"10.21203/rs.3.rs-3588406/v2","doiUrl":"https://doi.org/10.21203/rs.3.rs-3588406/v2","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":55189622,"identity":"e1f6c875-6bf1-4347-adf4-493be187304a","added_by":"auto","created_at":"2024-04-23 19:08:24","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":761553,"visible":true,"origin":"","legend":"","description":"","filename":"SSADLogWholeLifecycleTuningAnomalyDetectionwithSmallSampleLogs.pdf","url":"https://assets-eu.researchsquare.com/files/rs-3588406/v2_covered_2c81b641-79bb-4d1f-95a8-1d064b8096ec.pdf"}],"financialInterests":"The authors declare no competing interests.","formattedTitle":"SSADLog: Whole Lifecycle Tuning Anomaly Detection with Small Sample Logs","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"Anomaly detection, small samples, whole lifecycle tuning, log messages, language model","lastPublishedDoi":"10.21203/rs.3.rs-3588406/v2","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-3588406/v2","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eLog messages play a critical role in system analysis and issue resolution, particularly in complex software-intensive systems that demand high availability and quality assurance. However, log-based anomaly detection faces three major challenges. Firstly, millions of log data poses a significant labeling challenge. Secondly, log data tends to exhibit a severe class imbalance. Thirdly, the task of anomaly detection in such massive datasets requires both high accuracy and efficiency. Numerous deep learning based methods have been proposed to tackle those challenges. Yet, a comprehensive solution that effectively addresses all these issues has remained elusive. After meticulously analyzing log messages from some stable systems, we have observed a common trend: the number of unique anomaly logs is consistently small. Based on this observation, we present a novel framework called ''Whole Lifecycle Tuning Anomaly Detection with Small Sample Logs'' (SSADLog). SSADLog introduces a hyper-efficient log data pre-processing method that generates a representative subset of small sample logs. It leverages a pre-trained bidirectional encoder representations from transformers (BERT) language model to create contextual word embeddings. Furthermore, a semi-supervised fine-tuning process is employed for enhancing detection accuracy. SSADLog distinguishes itself with its capability to achieve high-performance iterations by fine-tuning language models with small size log samples. Extensive experimental evaluations show that SSADLog greatly reduces the effort to detect anomaly log messages from millions of daily new logs and outperforms the previous representative methods across various log datasets in terms of precision, recall, and F1 score.\u003c/p\u003e","manuscriptTitle":"SSADLog: Whole Lifecycle Tuning Anomaly Detection with Small Sample Logs","msid":"","msnumber":"","nonDraftVersions":[{"code":2,"date":"2024-04-23 18:52:15","doi":"10.21203/rs.3.rs-3588406/v2","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}},{"code":1,"date":"2023-11-13 21:50:30","doi":"10.21203/rs.3.rs-3588406/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"e3e212cd-e69e-46b1-8c38-5126673f4a20","owner":[],"postedDate":"April 23rd, 2024","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[],"tags":[],"updatedAt":"2024-02-10T09:01:13+00:00","versionOfRecord":[],"versionCreatedAt":"2024-04-23 18:52:15","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v2","identity":"rs-3588406","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-3588406","identity":"rs-3588406","version":["v2"]},"buildId":"qtupq5eGEP_6zYnWcrvyt","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}