The Sub-Sequence Summary Method for Detecting Anomalies in Logs

This paper introduces a novel method for detecting log anomalies using deep learning. In contrast to state-of-the-art methods that rely on sequence models such as LSTMs or Transformers, our approach does not require the subsequent log lines to be fed directly into the model. Instead, we extract specific features from the log sequence, and derive anomaly scores from the reconstruction loss of an ordinary auto-encoder. These features are easy to obtain and contain sequential information. The presented method can detect both sequence and attribute anomalies using a single integrated model. We present two variants: a template-based method and a fully semantic-based method.