CSLog: Anomaly Detection for Syslog Based on Contrastive Self-Supervised Representation Learning

In recent years, as the scale of computer clusters has expanded, maintaining stable system operation and timely detection of system anomalies have become significant challenges. System logs play an essential role in anomaly detection, and numerous methods have been proposed for detecting system anomalies using logs. However, these methods face challenges such as extreme data class imbalance, lack of labeled data, and low detection performance. In this paper, we present a contrastive self-supervised representation learning-based system log anomaly detection method, CSLog. This novel approach employs contrastive self-supervised representation learning to directly learn high-quality log sequence representations from easily obtainable normal log data, enabling downstream unsupervised detection methods to achieve state-of-the-art (SOTA) log anomaly detection performance. Furthermore, our method utilizes a distance-based anomaly modeling approach, avoiding parsing errors caused by the log parsing step required in traditional unsupervised log anomaly detection methods and simplifying the detection process. Experimental results demonstrate that our method achieves an f1-score of 96.7% on the HDFS dataset, surpassing the 95.3% achieved by supervised learning-based methods. Additionally, CSLog’s performance outperforms other unsupervised learning methods in comparative experiments.