Log Anomaly Detection Method Based on Transformer and Temporal Convolutional Networks

The analysis of log data is crucial for monitoring system operation and user activities. However, as the scale of software systems continues to expand, the format of log data has become more complex, and the volume of data is increasing exponentially. Existing log anomaly detection methods struggle to effectively handle this log data, resulting in poor detection performance. To overcome these challenges, it is essential to effectively utilize log features and fully exploit the local correlations and long-range dependencies within the log sequences. To address this, this paper proposes a log anomaly detection method based on global and local feature extraction, TranConvAD, with innovations in the following areas: 1) Multi-feature embedding strategy: TranConvAD directly utilizes time information, risk levels, and semantic features from the logs, avoiding the impact of information loss and parsing errors in traditional log analysis. 2) Multi-type word embedding method: To enhance the semantic representation of logs, this paper designs a word embedding method that integrates Bert and FastText, balancing both contextual semantics and subword information. 3) Dual-channel feature extraction: TranConvAD combines the global dependency capture of Transformer with the local temporal modeling of the time convolution network for the first time. Additionally, the introduction of separable self-attention and pointwise convolutions optimizes the model structure, significantly reducing the number of parameters. Experimental results show that the method achieves a maximum precision of 99.8% on the HDFS dataset (3.8% higher than LogAnomaly) and a maximum precision of 98.6% on the BGL dataset (3.4% higher than LightLog), demonstrating its effectiveness in detecting anomalies in log data.