LogAction: Consistent Cross-system Anomaly Detection through Logs via Active Domain Adaptation

2025/09/29 by Chiming Duan, Duan, Chiming, Minghua He +24 · 1 citation
Computer Science · Engineering · #Anomaly Detection Techniques and Applications #Artificial Intelligence (cs.AI) #Distributed #FOS: Computer and information sciences #Machine Learning (cs.LG) #Network Security and Intrusion Detection #Parallel #Smart Grid Security and Resilience #Software Engineering (cs.SE) #and Cluster Computing (cs.DC)

paper · pdf · doi:10.48550/arxiv.2510.03288

openalex publication_date 2025/09/29 · openalex created_date 2025/10/09 · openalex updated_date 2026/07/31

Abstract

Log-based anomaly detection is a essential task for ensuring the reliability and performance of software systems. However, the performance of existing anomaly detection methods heavily relies on labeling, while labeling a large volume of logs is highly challenging. To address this issue, many approaches based on transfer learning and active learning have been proposed. Nevertheless, their effectiveness is hindered by issues such as the gap between source and target system data distributions and cold-start problems. In this paper, we propose LogAction, a novel log-based anomaly detection model based on active domain adaptation. LogAction integrates transfer learning and active learning techniques. On one hand, it uses labeled data from a mature system to train a base model, mitigating the cold-start issue in active learning. On the other hand, LogAction utilize free energy-based sampling and uncertainty-based sampling to select logs located at the distribution boundaries for manual labeling, thus addresses the data distribution gap in transfer learning with minimal human labeling efforts. Experimental results on six different combinations of datasets demonstrate that LogAction achieves an average 93.01% F1 score with only 2% of manual labels, outperforming some state-of-the-art methods by 26.28%. Website: https://logaction.github.io

Citations

• Adaptive Root Cause Localization for Microservice Systems with Multi-Agent Recursion-of-Thought
• ThinkFL: Self-Refining Failure Localization for Microservice Systems via Reinforcement Fine-Tuning
• Enhancing Web Service Anomaly Detection via Fine-grained Multi-modal Association and Frequency Domain Analysis
• Loss-based Sequential Learning for Active Domain Adaptation
• Active Learning for Domain Adaptation: An Energy-Based Approach
• Loghub: A Large Collection of System Log Datasets for AI-driven Log Analytics
• BART: Denoising Sequence-to-Sequence Pre-training for Natural Language Generation, Translation, and Comprehension
• Active Adversarial Domain Adaptation
• Efficient Estimation of Word Representations in Vector Space
• Long Short-Term Memory

Cited by

• FusionLog: Cross-System Log-based Anomaly Detection via Fusion of General and Proprietary Knowledge

Related

• LogSD: Detecting Anomalies from System Logs through Self-supervised Learning and Frequency-based Masking
• ALPHA: LLM-Enabled Active Learning for Human-Free Network Anomaly Detection
• ZeroLog: Zero-Label Generalizable Cross-System Log-based Anomaly Detection
• From Few-Label to Zero-Label: An Approach for Cross-System Log-Based Anomaly Detection with Meta-Learning
• Semi-supervised learning via DQN for log anomaly detection