Study on Software Log Anomaly Detection System with Unsupervised Learning Algorithm

Abstract

In recent years, the existence of open source software (OSS) is indispensable for software development. While developer can benefit from functions of OSS, there is a problem that it is very difficult to locate the cause when problems occur. In this study, we propose a method to calculate anomaly score for each line of log data. In our method, the temporal pattern is learned using Hierarchical Temporal Memory, which is an unsupervised real-time learning algorithm, and the anomaly score is obtained based on the internal state of the model. In the experiment, we compare the learning situation in the following three input formats, word ID, word embedding, and sentence embedding. In the experiments using actual log data, it was found that the method with word ID has the highest f1 score and runtime performance, but the precision needs to be improved in order to suppress useless information.