LogPrompt: A Log-based Anomaly Detection Framework Using Prompts

Log data are widely used in anomaly detection tasks of software system. At present, log anomaly detection methods based on deep learning have greatly progressed. However, the existing methods have the following limitations: (1) Logs are at large scale but labeled logs are rare, so training a detection model that requires a number of labeled log data from scratch is costly and impractical; (2) Log anomaly detection tasks usually need to comprehensively consider the semantic and sequential information in logs, but most of the current log anomaly detection frameworks only build models from either aspect; (3) Normal and abnormal logs are imbalanced in real world, which seriously reduces the detection recalls. This paper proposes a log anomaly detection framework called LogPrompt to solve the problems mentioned above. LogPrompt leverages prompts to guide the pretrained language model (PLM) to better learn the semantic and sequential information of logs, and avoids training a model from scratch. Even with few training data, the model achieves good detection performance. Moreover, it uses focal loss instead of cross entropy loss to guide the model optimization during training stage, for alleviating the class imbalance problem. Experiments show that LogPrompt can detect log anomalies more effectively and efficiently by prompts, and it can significantly improve the recalls and F1 scores.