SeqLog: Surface-Invariant Detection and Event Localization in System Logs
Resumo
Log-based attack detectors are brittle to surface-token variation (commands, hosts, paths) that preserves operational meaning, flag windows without localizing the responsible events, and lose cross-domain F1 under source-selected decision thresholds. We address these failures in a sequence-classification pipeline (SeqLog) with three components. First, Surface-Invariance Consistency Training (SICT) pairs each log window with a semantics-preserving lexical rewrite and penalizes prediction divergence via a symmetric KL term. Second, an attention-MIL pooling head matches the weak-label structure of log windows (“positive if any event is malicious”) and yields event-level localization from window labels alone. Third, label-free threshold transport addresses cross-domain operating-point mismatch by transporting the source predicted-positive rate to a quantile of the target score distribution, using zero target labels. On a controlled two-domain benchmark, the model reaches F1 0.979/0.976 on unseen signatures, localization AUC 0.966 in both domains, and recovers cross-domain F1 from 0.259 to 0.865 on WINDOWS → LINUX (oracle 0.872). On public corpora (HDFS, BGL, AIT-LDS), the pipeline stays competitive and reproduces the localization and transport patterns where their preconditions hold.
Referências
Guan, W., Cao, J., Qian, S., Gao, J., and Ouyang, C. (2024). LogLLM: Log-based anomaly detection using large language models. arXiv preprint arXiv:2411.08561.
Guo, H., Yuan, S., and Wu, X. (2021). LogBERT: Log anomaly detection via BERT. In IJCNN, pages 1–8.
He, P., Zhu, J., Zheng, Z., and Lyu, M. (2017). Drain: An online log parsing approach with fixed depth tree. In ICWS, pages 47–56.
Hu, E., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., and Chen, W. (2022). LoRA: Low-rank adaptation of large language models. In ICLR.
Ilse, M., Tomczak, J., and Welling, M. (2018). Attention-based deep multiple instance learning. In ICML, pages 2127–2136.
Le, V. and Zhang, H. (2021). Log-based anomaly detection without log parsing. arXiv preprint arXiv:2108.01955.
Li, X., Chen, P., Jing, L., He, Z., and Yu, G. (2022). SwissLog: Robust anomaly detection and localization for interleaved unstructured logs. IEEE Transactions on Dependable and Secure Computing.
Liang, X., Wu, L., Li, J., Wang, Y., Meng, Q., Qin, T., Chen, W., Zhang, M., and Liu, T.-Y. (2021). R-Drop: Regularized dropout for neural networks. In NeurIPS.
Ma, Z., Yang, J., and Chen, T.-H. (2026). LLM4Log: A systematic review of large language model-based log analysis. arXiv preprint arXiv:2604.16359.
Meng, W., Liu, Y., Zhu, J., et al. (2019). LogAnomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs. In IJCAI, pages 4739–4745.
Otsu, N. (1979). A threshold selection method from gray-level histograms. IEEE Transactions on Systems, Man, and Cybernetics, 9(1):62–66.
Saerens, M., Latinne, P., and Decaestecker, C. (2002). Adjusting the outputs of a classifier to new a priori probabilities: A simple procedure. Neural Computation, 14(1):21–41.
Xie, Q., Dai, Z., Hovy, E., Luong, M.-T., and Le, Q. (2020). Unsupervised data augmentation for consistency training. In ICLR.
Zhang, X., Xu, Y., Lin, Q., Qiao, B., Zhang, H., Dang, Y., Xie, C., Yang, X., Cheng, Q., Li, Z., Chen, J., He, X., Yao, R., Lou, J.-G., Chintalapati, M., Shen, F., and Zhang, D. (2019). Robust log-based anomaly detection on unstable log data. In ESEC/FSE, pages 807–817.
Zhu, J., He, S., He, P., Liu, J., and Lyu, M. R. (2023). Loghub: A large collection of system log datasets for AI-driven log analytics. In ISSRE.
Zhu, J., He, S., Liu, J., He, P., Xie, Q., Zheng, Z., and Lyu, M. (2019). Tools and benchmarks for automated log parsing. In ICSE-SEIP, pages 121–130.
