GALLog: A Graph-based Log Anomaly Detection Method with Active Learning

System logs continuously record the status and internal operation details of the system, playing a vital role in locating and resolving software anomalies. Recently, numerous deep learning-based methods have been proposed to detect system anomalies via log analysis. However, there are still several critical challenges remain to be addressed. First, existing methods are highly dependent on expensive and manually-curated labeling information. Second, the mainstream method of using sequence models to represent log information can be insufficient. To tackle these challenges, we propose GALLog, a graph-based log anomaly detection method that incorporates active learning. GALLog starts by transforming log sequences into graphs and learns neglected structural information in sequence models by graph attention network. To maximize the use of limited labeling budget, we introduce a hybrid active learning strategy to select valuable log entries for labeling. Specifically, the representative strategy ensures samples diversity while the uncertainty strategy focuses on capturing low-confidence samples. Additionally, we designed a data augmentation method using graph representation learning, which is used to reduce sample redundancy and further enhance uncertain samples. Experiments indicate that GALLog outperforms compared approaches under realistic low labeling budgets, and extensive ablation experiments have proven the effectiveness of each component in our design.