LAnoBERT : System Log Anomaly Detection based on BERT Masked Language
  Model
  The system log generated in a computer system refers to large-scale data that
are collected simultaneously and used as the basic data for determining simple
errors and detecting external adversarial intrusion or the abnormal behaviors
of insiders. The aim of system log anomaly detection is to promptly identify
anomalies while minimizing human intervention, which is a critical problem in
the industry. Previous studies performed anomaly detection through algorithms
after converting various forms of log data into a standardized template using a
parser. These methods involved generating a template for refining the log key.
Particularly, a template corresponding to a specific event should be defined in
advance for all the log data using which the information within the log key may
get lost.In this study, we propose LAnoBERT, a parser free system log anomaly
detection method that uses the BERT model, exhibiting excellent natural
language processing performance. The proposed method, LAnoBERT, learns the
model through masked language modeling, which is a BERT-based pre-training
method, and proceeds with unsupervised learning-based anomaly detection using
the masked language modeling loss function per log key word during the
inference process. LAnoBERT achieved better performance compared to previous
methodology in an experiment conducted using benchmark log datasets, HDFS, and
BGL, and also compared to certain supervised learning-based models.
