RAGLog: Log Anomaly Detection using Retrieval Augmented Generation

TL;DR

RAGLog introduces a novel retrieval-augmented large language model approach utilizing a vector database to detect log anomalies, addressing challenges of data volume, variety, and scarcity of labeled anomalies in system logs.

Contribution

The paper presents RAGLog, a new method that combines retrieval-augmented generation with large language models for effective log anomaly detection.

Findings

Demonstrates promising results in anomaly detection accuracy.

Addresses data scarcity by leveraging retrieval-augmented techniques.

Shows potential for improving cyber resiliency through automated log analysis.

Abstract

The ability to detect log anomalies from system logs is a vital activity needed to ensure cyber resiliency of systems. It is applied for fault identification or facilitate cyber investigation and digital forensics. However, as logs belonging to different systems and components differ significantly, the challenge to perform such analysis is humanly challenging from the volume, variety and velocity of logs. This is further complicated by the lack or unavailability of anomalous log entries to develop trained machine learning or artificial intelligence models for such purposes. In this research work, we explore the use of a Retrieval Augmented Large Language Model that leverages a vector database to detect anomalies from logs. We used a Question and Answer configuration pipeline. To the best of our knowledge, our experiment which we called RAGLog is a novel one and the experimental results show much promise.