MvLog: Mining Invariants by Recovering Workflow on Log for Anomaly Detection
Bowen Tian, Guang Chen, Zhiwen Wang, Yucheng Zhang, Hong Zhou · 2023
Abnormal features and normal features are the key to log anomaly detection. There are various features, but software workflow features are undoubtedly the most fundamental ones. So, this paper presents a novel method to restore workflow and construct the invariants, which we call it as MvLog. MvLog first uses modified Drain to obtain log events and corresponding parameters, then uses the improved Apriori to find related event sequences, and finally analyses the relationship between the event sequences to recover workflow fragment which are considered as the invariants for log anomaly detection. We had developed the MvLog prototype system and tested it with 11 kinds of log provided by LogHub. Experiments show that MvLog is capable of recovering the workflow fragment as invariants with an acceptable overhead.