Detecting Log Anomalies with Multi-Head Attention (LAMA)
This work addresses the problem of detecting anomalies in computer system and user behavior logs, which is important for system reliability and security.
This paper tackles log anomaly detection by analyzing sequential information in log streams. The proposed LAMA model, based on multi-head attention, is trained on a next event prediction task and empirically outperforms existing statistical and deep learning methods for log anomaly detection.
Anomaly detection is a crucial and challenging subject that has been studied within diverse research areas. In this work, we explore the task of log anomaly detection (especially computer system logs and user behavior logs) by analyzing logs' sequential information. We propose LAMA, a multi-head attention based sequential model to process log streams as template activity (event) sequences. A next event prediction task is applied to train the model for anomaly detection. Extensive empirical studies demonstrate that our new model outperforms existing log anomaly detection methods including statistical and deep learning methodologies, which validate the effectiveness of our proposed method in learning sequence patterns of log data.