Adaptive Semantic Gate Networks (ASGNet) for log-based anomaly diagnosis
This February 2024 paper proposes an approach called Adaptive Semantic Gate Networks (ASGNet) for log-based anomaly diagnosis.
The key ideas is that existing log anomaly diagnosis methods do not make full use of two important types of features in log data:
a) Statistical features: inherent statistical characteristics like word frequency and abnormal label distribution
b) Semantic features: the deep semantic relationships between log statements based on the execution logic they represent
ASGNet aims to effectively combine these statistical and semantic features to improve log anomaly diagnosis performance.
It consists of three main components:
a) Log Statistics Information Representation (V-Net): Uses an unsupervised variational autoencoder to learn a global representation of each statistical feature vector. This maps the discrete statistical vectors into a latent continuous space.
b) Log Deep Semantic Representation (S-Net): Extracts semantic features from the log message input using a pre-trained RoBERTa model. The semantic features are projected into an information space to evaluate their confidence in the decision-making process.
c) Adaptive Semantic Threshold Mechanism (G-Net): Aligns the statistical and semantic information and adjusts the information flow. It uses a gate function to selectively fuse useful statistical information into low-confidence semantic features based on a confidence threshold. This helps train a robust classifier while avoiding overfitting.

Extensive experiments are conducted on 7 public log datasets of different scales.
The results show that:
a) ASGNet significantly outperforms state-of-the-art baseline methods for log anomaly diagnosis on all datasets.
b) Both the statistical and semantic representation components contribute to the overall performance, with the semantic representation being more important.
The adaptive semantic gate is crucial for the model's effectiveness. c) Model performance is sensitive to the hidden state dimension and confidence threshold hyperparameters.
In summary, ASGNet innovatively leverages both statistical and semantic features in log data through a gating mechanism to enhance log anomaly diagnosis. The strong empirical results validate the effectiveness of this approach.
Last updated
Was this helpful?