A Graph-Based Unsupervised Log Anomaly Detection Based on the Magnetic Laplacian

Logs record the runtime status of software systems and detailed information of user operations. However, due to the complexity and heterogeneity of log formats and semantics, log anomaly detection work faces challenges. Most existing log anomaly detection methods only consider the quantitative and/or sequential relationships, while ignoring the directional information within logs, which may result in low detection accuracy. In addition, the high cost of manual annotation for logs is another challenge to effective log analysis. To address the aforementioned challenges, this paper introduces L2G-Log, a graph-based unsupervised method for log anomaly detection. The method begins by constructing logs into directed, attributed, and weighted graphs, followed by employing graph neural networks for graph-level anomaly detection. Specially, we introduce a One-Class graph convolutional neural network based on the magnetic Laplacian called OCMagNet. Firstly, it extracts the directional information in log graphs through the magnetic Laplacian and generates a vector representation for each node in graphs. Then, it utilizes Readout(·) to aggregate vector representations into a graph representation for each log graph. Finally, DeepSVDD is employed to identify anomalies without manual labeling of log data. Experiments conducted on two benchmark datasets demonstrate that L2G-Log achieves performance that is on par with or surpasses existing anomaly detection methods.