A Taxonomy of Anomalies in Log Data
This work provides a domain-specific taxonomy to help researchers and IT operators choose anomaly detection methods for log data, but it is incremental as it adapts an existing taxonomy to a new domain.
The paper tackles the problem of selecting appropriate anomaly detection methods for log data by developing a taxonomy specific to log anomalies and evaluating five state-of-the-art unsupervised algorithms on benchmark datasets. Results show that deep learning-based approaches outperform data mining-based ones, particularly for contextual anomalies, with the most common anomaly type being the easiest to predict.
Log data anomaly detection is a core component in the area of artificial intelligence for IT operations. However, the large amount of existing methods makes it hard to choose the right approach for a specific system. A better understanding of different kinds of anomalies, and which algorithms are suitable for detecting them, would support researchers and IT operators. Although a common taxonomy for anomalies already exists, it has not yet been applied specifically to log data, pointing out the characteristics and peculiarities in this domain. In this paper, we present a taxonomy for different kinds of log data anomalies and introduce a method for analyzing such anomalies in labeled datasets. We applied our taxonomy to the three common benchmark datasets Thunderbird, Spirit, and BGL, and trained five state-of-the-art unsupervised anomaly detection algorithms to evaluate their performance in detecting different kinds of anomalies. Our results show, that the most common anomaly type is also the easiest to predict. Moreover, deep learning-based approaches outperform data mining-based approaches in all anomaly types, but especially when it comes to detecting contextual anomalies.