OneLog: Towards End-to-End Training in Software Log Anomaly Detection
  In recent years, with the growth of online services and IoT devices, software
log anomaly detection has become a significant concern for both academia and
industry. However, at the time of writing this paper, almost all contributions
to the log anomaly detection task, follow the same traditional architecture
based on parsing, vectorizing, and classifying. This paper proposes OneLog, a
new approach that uses a large deep model based on instead of multiple small
components. OneLog utilizes a character-based convolutional neural network
(CNN) originating from traditional NLP tasks. This allows the model to take
advantage of multiple datasets at once and take advantage of numbers and
punctuations, which were removed in previous architectures. We evaluate OneLog
using four open data sets Hadoop Distributed File System (HDFS), BlueGene/L
(BGL), Hadoop, and OpenStack. We evaluate our model with single and
multi-project datasets. Additionally, we evaluate robustness with synthetically
evolved datasets and ahead-of-time anomaly detection test that indicates
capabilities to predict anomalies before occurring. To the best of our
knowledge, our multi-project model outperforms state-of-the-art methods in
HDFS, Hadoop, and BGL datasets, respectively setting getting F1 scores of
99.99, 99.99, and 99.98. However, OneLog's performance on the Openstack is
unsatisfying with F1 score of only 21.18. Furthermore, Onelogs performance
suffers very little from noise showing F1 scores of 99.95, 99.92, and 99.98 in
HDFS, Hadoop, and BGL.
