Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Error of LogAnomaly implementation. #14

Open
LeonYang95 opened this issue Aug 21, 2020 · 7 comments
Open

Error of LogAnomaly implementation. #14

LeonYang95 opened this issue Aug 21, 2020 · 7 comments

Comments

@LeonYang95
Copy link

Hi,

Thank you so much for this amazing project!
I am recently playing with different methods here in this project, however, I do find something odd about the implementation of LogAnomaly. Here in this project, LogAnomaly is actually using log event ids within a window to predict the next event id, just the same as DeepLog, which seems wrong.

According to the paperwork of LogAnomaly, it seems using "semantic vectors" for the prediction (the prediction is an event id or semantic vector, either way is good).

So, as far as I can see, should we change the inputs of LogAnomaly from Sequentials and Quantitives to Semantics and Quantitives ?

Please correct me if I misunderstood something. Thanks again for sharing the project!

Lin, Yang

@asimokby
Copy link

Hey @YangLin-George,

Have you got an answer to this?

@LeonYang95
Copy link
Author

LeonYang95 commented Dec 29, 2020

Hi, @asimokby ,

I'm not sure what is the "answer" you mean. But according to the discussion with authors of LogAnomaly, they did not open-source their implementation due to several concerns. This project is the only one I can find in GitHub which combines DeepLog, LogAnomaly and LogRobust.

As for the inappropriate implementation of LogAnomaly. I was debugging LogAnomaly, and found out that the size of the input tensor of loganomaly model in logdeep/models/lstm.py is (2048, L, 1) where 2048 means batch_size. L is the length of input. That means the input for each sequence in this batch is only a (L, 1) vector.

I'm not sure what the id (1 in the input size) is, but seems like there's one step missing which maps event ids into high-demensional vectors in data/hdfs/evene2semantic_vec.json, like word embedding in NLP tasks.

I'm currently not interested in LogAnomaly after we discussed with the authors. So, if you want more details, you can reach out to them directly.

If you are studying log anomaly detection, There's one paper accepted by ICSE2021 that you may be interested.

If you have any other question, you can email me directly, my email address is linyang[AT]tju.edu.cn.

Best,
Lin Yang

@KiteFlyKid
Copy link

Hi@YangLin-George
You're right. An additional step to implement dLCE for template2vec is required.

By the way, why you are not interested in LogAnomaly? I am currently doing research on deep learning-based log anomaly detection and maybe you could leave me an email and we can discuss a little.

And I was wondering if you could please tell me which paper you mentioned in ICSE2021.
Thanks.

@LeonYang95
Copy link
Author

Hi @KiteFlyKid ,
Thank you.
My email address is linyang[AT]tju.edu.cn. You can email me as much as you want, I'm happy to discuss with other researchers! :D

@ZhongLIFR
Copy link

Hi,

Thank you so much for this amazing project! I am recently playing with different methods here in this project, however, I do find something odd about the implementation of LogAnomaly. Here in this project, LogAnomaly is actually using log event ids within a window to predict the next event id, just the same as DeepLog, which seems wrong.

According to the paperwork of LogAnomaly, it seems using "semantic vectors" for the prediction (the prediction is an event id or semantic vector, either way is good).

So, as far as I can see, should we change the inputs of LogAnomaly from Sequentials and Quantitives to Semantics and Quantitives ?

Please correct me if I misunderstood something. Thanks again for sharing the project!

Lin, Yang

After reading the original LogAnomaly paper, I found that this implementation is somewhat incorrect. In the LogAnomaly paper, they indeed use SemanticVector and CountVector as inputs for their LSTM model. However, they original authors did not describe how to use "attention" to connect these two inputs in their original paper. That is a big pity that they did not open-source their code!

@alexjamesmx
Copy link

Hi @LeonYang95 Im trying to email you but the email format doesn't seem to be correct. How can I reach you?

@LeonYang95
Copy link
Author

Hi @LeonYang95 Im trying to email you but the email format doesn't seem to be correct. How can I reach you?

Hi @alexjamesmx , you can try [email protected]

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

5 participants