LogESP: Enhancing Log Semantic Representation With Word Position for Anomaly Detection

Logs are valuable data for detecting anomalous network behavior. Accurate feature extraction from logs is essential for anomaly detection. However, statistical-based feature extraction methods consider the statistical features of logs over a period of time, while ignoring the semantic information in each log. Most semantic-based feature extraction methods only embed the token semantics into high-dimensional vectors for semantic representation, which may lead to the lack of positional information between tokens, so that the uniqueness of the log template semantics cannot be maintained. At the same time, it also causes time-consuming problems due to high-dimensional data. To address the above challenges, we propose a novel log anomaly detection method called LogESP, which enhances the semantic representation of logs with positional information. Lo-gESP aims to effectively capture the semantic differences between normal and abnormal logs, thereby providing a new perspective for accurate detection of abnormal network behavior. First, we select representative words to summarize the semantics of log templates, then use structured tuples to enhance the semantic representation of the templates, and finally, construct LSTM model to extract the temporal features of the log sequences. Experimental results on two public log datasets (BGL and HDFS) show better performance compared to other state-of-the-art methods.