Vol.37, No.1, 2021, pp.135-148, doi:10.32604/csse.2021.014030
A Generative Adversarial Networks for Log Anomaly Detection
  • Xiaoyu Duan1, Shi Ying1,*, Wanli Yuan1, Hailong Cheng1, Xiang Yin2
1 School of Computer Science, Wuhan University, Wuhan, 430072, China
2 Institute of Information Engineering, Chinese Academy of Sciences, Beijing, 100093, China
* Corresponding Author: Shi Ying. Email:
Received 30 August 2020; Accepted 22 September 2020; Issue published 05 February 2021
Detecting anomaly logs is a great significance step for guarding system faults. Due to the uncertainty of abnormal log types, lack of real anomaly logs and accurately labeled log datasets. Existing technologies cannot be enough for detecting complex and various log point anomalies by using human-defined rules. We propose a log anomaly detection method based on Generative Adversarial Networks (GAN). This method uses the Encoder-Decoder framework based on Long Short-Term Memory (LSTM) network as the generator, takes the log keywords as the input of the encoder, and the decoder outputs the generated log template. The discriminator uses the Convolutional Neural Networks (CNN) to identify the difference between the generated log template and the real log template. The model parameters are optimized automatically by iteration. In the stage of anomaly detection, the probability of anomaly is calculated by the Euclidean distance. Experiments on real data show that this method can detect log point anomalies with an average precision of 95%. Besides, it outperforms other existing log-based anomaly detection methods.
Generative adversarial networks; anomaly detection; data mining; deep learning
Cite This Article
X. Duan, S. Ying, W. Yuan, H. Cheng and X. Yin, "A generative adversarial networks for log anomaly detection," Computer Systems Science and Engineering, vol. 37, no.1, pp. 135–148, 2021.
This work is licensed under a Creative Commons Attribution 4.0 International License , which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.