LogGPT: Log Anomaly Detection via GPT

TL;DR

LogGPT introduces a GPT-based framework for log anomaly detection, employing language modeling and reinforcement learning to improve detection accuracy over existing methods.

Contribution

The paper presents LogGPT, a novel GPT-based approach with reinforcement learning finetuning specifically designed for log anomaly detection.

Findings

LogGPT outperforms state-of-the-art methods on three datasets.

Reinforcement learning finetuning enhances anomaly detection performance.

GPT-based modeling effectively captures log sequence patterns.

Abstract

Detecting system anomalies based on log data is important for ensuring the security and reliability of computer systems. Recently, deep learning models have been widely used for log anomaly detection. The core idea is to model the log sequences as natural language and adopt deep sequential models, such as LSTM or Transformer, to encode the normal patterns in log sequences via language modeling. However, there is a gap between language modeling and anomaly detection as the objective of training a sequential model via a language modeling loss is not directly related to anomaly detection. To fill up the gap, we propose LogGPT, a novel framework that employs GPT for log anomaly detection. LogGPT is first trained to predict the next log entry based on the preceding sequence. To further enhance the performance of LogGPT, we propose a novel reinforcement learning strategy to finetune the model specifically for the log anomaly detection task. The experimental results on three datasets show that LogGPT significantly outperforms existing state-of-the-art approaches.