VarLog: Mining Invariants with Variables for Log Anomaly Detection
Hong Zhou, Yuanyuan Pan, Guang Chen, Yucheng Zhang, Jinhui Yuan · 2023
The invariants used in existing log anomaly detection usually do not contain the variables. The cause is that the dynamic nature of variables makes it difficult to construct the invariants. However, the variables recorded some valuable information in the log, and constructing the invariants containing the variables allow us to discover exceptions more accurately.In this paper, we propose a novel method to mine the invariant with variables, which we call VarLog. VarLog first obtains associated event sequences with the modified aprioir, then identifies valuable variables and fuses them with associated event sequences to form the invariants. We have built the VarLog prototype system and tested it on the dataset provided by LogHub. The experiments show that VarLog is capable of finding invariants with variables in nine kinds of log.