TransFlowLog: Log Anomaly Detection Based on Transformer Encoder and Interflow Decoder

Logs are valuable resources that record the health status of systems. Analyzing logs to uncover and investigate abnormal behaviors has become an essential approach of ensuring system security. However, some potential anomalies may be missed when performing log anomaly detection, and even a seemingly insignificant abnormal behavior can lead to a series of severe anomalies or continuous negative impact on the performance of systems. Therefore, the reliability and security of systems are facing significant challenges. To address this issue, in this study, we propose TransFlowLog, an Encoder-Decoder architecture-based approach for log anomaly detection. It utilizes the Transformer Encoder, a state-of-the-art sequence modeling technique, to comprehensively understand contextual relationships using self-attention mechanism. Moreover, we introduce the Interflow Decoder, which considers information exchange between channels in embedded log sequences. The Interflow Decoder enhances the features encoded by the Transformer Encoder in both sequence and channel dimensions, thereby capturing interdependence between different channels. Comparative experiments conducted on three real-world datasets demonstrate the effectiveness of the proposed method, as it achieves higher F1-score and reduces the number of false negatives.