Log-Based Anomaly Detection Without Ground-Truth: Evaluating Weakly Supervised, Semi-Supervised, and Unsupervised Deep Learning Approaches

Log-based anomaly detection has emerged as an essential approach for monitoring industrial systems, ensuring the reliability and security of extensive data-driven devices. As the volume and complexity of log data continue to rise, numerous machine learning and deep learning techniques have been widely used for automated log-based anomaly detection. While, supervised methods achieve impressive accuracy, their dependence on labeled logs poses a significant challenge, particularly in real-world applications where labeled data are limited. Conventional approaches, such as comprehensive manual labeling or entirely unsupervised techniques, frequently result in high false-positive rates, restricting their efficacy in industrial settings. In this paper, we conduct a thorough evaluation of advanced deep learning models for log-based anomaly detection across weakly supervised, semi-supervised, and unsupervised learning paradigms, employing system logs produced by an intelligent and autonomous display device. We evaluate the performance of these models against fully supervised baselines, examining the tradeoffs between various learning approaches within an industrial context. Furthermore, we present a systematic approach for managing unlabeled real-world log data, providing practical guidelines on choosing the most suitable learning strategy according to label availability, data quality, and industry limitations.