FastLogAD: Log Anomaly Detection with Mask-Guided Pseudo Anomaly
  Generation and Discrimination
Yifei Lin Hanqiu Deng Xingyu Li
Nowadays large computers extensively output logs to record the runtime status
and it has become crucial to identify any suspicious or malicious activities
from the information provided by the realtime logs. Thus, fast log anomaly
detection is a necessary task to be implemented for automating the infeasible
manual detection. Most of the existing unsupervised methods are trained only on
normal log data, but they usually require either additional abnormal data for
hyperparameter selection or auxiliary datasets for discriminative model
optimization. In this paper, aiming for a highly effective discriminative model
that enables rapid anomaly detection,we propose FastLogAD, a
generator-discriminator framework trained to exhibit the capability of
generating pseudo-abnormal logs through the Mask-Guided Anomaly Generation
(MGAG) model and efficiently identifying the anomalous logs via the
Discriminative Abnormality Separation (DAS) model. Particularly,
pseudo-abnormal logs are generated by replacing randomly masked tokens in a
normal sequence with unlikely candidates. During the discriminative stage,
FastLogAD learns a distinct separation between normal and pseudoabnormal
samples based on their embedding norms, allowing the selection of a threshold
without exposure to any test data and achieving competitive performance.
Extensive experiments on several common benchmarks show that our proposed
FastLogAD outperforms existing anomaly detection approaches. Furthermore,
compared to previous methods, FastLogAD achieves at least x10 speed increase in
anomaly detection over prior work. Our implementation is available at
https://github.com/YifeiLin0226/FastLogAD.