LogMT: A Self-supervised Log Anomaly Detection Method Based on Multi-Tasks

With the rapid development of software systems, logs have become essential data for monitoring the security and stability of computer systems. Current log anomaly detection methods usually rely on large volumes of labeled data, which can lead to class imbalance and fail to fully leverage the features of log sequences. To address these problems, we propose a novel anomaly detection model LogMT, which performs anomaly detection based on multiple self-supervised tasks. LogMT uses Transformer encoder to extract feature vectors from log event sequences and trains the model through self-supervised tasks for anomaly detection. To better capture the bidirectional context information of log sequences, we introduce the dynamic masked log templates prediction task, which enhances the contextual understanding of the model through predicting masked log templates in the log sequence. In the minimization of outlier factor task, we map log sequence features to a high-dimensional space and cluster similar normal log sequences together, improving the model's capability to distinguish anomaly features. Finally, we conducted extensive experiments on three public datasets, and the experimental results demonstrate the effectiveness and superiority of LogMT.