Log-based anomaly detection (LAD) is imperative to ensure both the reliability and security of software systems. Although many deep learning approaches have been designed to capture complex and diverse anomaly patterns from log files, they heavily rely on large-scale annotated data. However, collecting sufficient labeled data is impractical when a software system has just been deployed. In this paper, we propose a cross-system few-shot learning log-based anomaly detection approach, namely FSLog, to solve the abnormal label scarcity problem, which is the main challenge of recent LAD research. Specifically, we leverage a pre-trained model from source system to enrich feature representations so that data instances from target system can also be effectively represented. To this end, we introduce a novel adversarial margin loss to enhance our feature distinguishability while preserving their generalizability. Further, we also develop a masked interactive temporal network for robust feature extraction of temporal relationships for log samples. We evaluate the proposed FSLog on three publicly available datasets based on a standard few-shot learning setup protocol. Experimental results demonstrate that our method achieves the best performance in detecting abnormal logs when compared to state-of-the-art methods.

Log anomaly detection (LAD) is of paramount importance to enhance the reliability and stability of software systems. Current state-of-the-art LAD suffers a significant performance degradation when dealing with consistently evolving log events caused by system updates. To build a reliable LAD model under the context of log data evolution, we propose an incremental learning-based method for LAD, namely ilLog, to avoid catastrophic forgetting of previously learned knowledge while continuously updating the model for better detection when processing the evolving log events. In particular, we design a novel entropy-driven sorting algorithm for real log sample replay, which enables the preservation of old knowledge via storing representative samples with discrete sequence features from previous tasks. Additionally, we introduce a Halton-based low discrepancy sequence to better approximate the sliced Cram´ er distance between the probability distributions of two models, thus enhancing the model learning capability. Based on a standard incremental learning protocol setting, we evaluate the newly proposed ilLog method on three publicly available datasets. Experimental results demonstrate that our approach achieves the best performance compared to SOTA LAD methods and models by applying existing IL-based methods in evolving software systems.

Log anomaly detection (LAD) is essential to ensure the safe and stable operation of Cyeber-physical systems. Although current LAD methods exhibit significant potential in addressing challenges posed by unstable log events and temporal sequence patterns, their limitations in detection efficiency and generalization ability present a formidable challenge when dealing with evolving systems. To construct a real-time and reliable online log anomaly detection model, we propose OMLog, a semi-supervised online meta-learning method, to effectively tackle the distribution shift issue caused by changes in log event types and frequencies. Specifically, we introduce a maximum mean discrepancy-based distribution shift detection method to identify distribution changes in unseen log sequences. Depending on the identified distribution gap, the method can automatically trigger online fine-grained detection or offline fast inference. Furthermore, we design an online learning mechanism based on meta-learning, which can effectively learn the highly repetitive patterns of log sequences in the feature space, thereby enhancing the generalization ability of the model to evolving data. Extensive experiments conducted on two publicly available log datasets, HDFS and BGL, validate the effectiveness of the OMLog approach. When trained using only normal log sequences, the proposed approach achieves the F1-Score of 93.7% and 64.9%, respectively, surpassing the performance of the state-of-the-art (SOTA) LAD methods and demonstrating superior detection efficiency.

Log-based anomaly detection (LAD) is one of the dominant approaches to improving the reliability and security of software systems. Presently, despite the efficacy demonstrated by state-of-the-art LAD approaches in processing static log events, their performance significantly degrades when confronting changes of log event types from system updates. To construct a reliable LAD model that could adapt well to the evolution of log data, we propose a method grounded in semi-supervised domain adaptation on the rationale of incremental log anomaly detection dubbed as SSDALog, which dynamically updates the model utilizing limited labeled samples to reconcile distributional shifts between evolving and historical data. Specifically, the proposed approach addresses the issue through two primary mechanisms: (i) creation of a cross-domain mixup algorithm, which computes the feature salience of log discrete sequences through occlusion strategy, thus enhancing the adaptability of the model to unknown patterns by mixing evolving features; and (ii) design of an incremental semi-supervised domain adaptation training framework based on noisy label learning to obtain a robust feature extractor, thus improving the generalization ability of the detection model. We empirically assess the efficacy of the SSDALog approach across two publicly available datasets. The experimental results show that our method outperforms the SOTA LAD approach, particularly for evolving systems.

Time series anomaly detection is crucial for improving the security and reliability of Cyber-Physical systems (CPS). While significant progress has been made, existing methods struggle to learn discriminative representations from multivariate time series with complex interactions and noise. To address this challenge, we propose a semi-supervised anomaly detection method based on denoising-aware contrastive learning, namely SSDCL, which can achieve robust performance for CPS anomaly detection using limited supervision. Specifically, we first design a similarity combination data augmentation algorithm to handle complex interactions among continuous sensor measurements and discrete actuator states. Furthermore, we develop a denoising hierarchical contrastive loss function that mitigates data noise interference while ensuring discriminative spatio-temporal representation. To validate the effectiveness of SSDCL, we conducted empirical evaluations on three publicly available CPS time series datasets including PUMP, SWaT and WADI. The experimental results show that the proposed method achieves F1 Score of 97.5%, 93.0%, and 74.4%, respectively, outperforming the state-of-the-art (SOTA) CPS anomaly detection methods.

The 3D point cloud is widely used in robot fields because of its accurate positioning results and dense environment information. However, most of the existing methods are real-time positioning and 3D reconstruction in unknown environments. In some scenes that require multiple regular operations, such as robot patrol and maintenance, the stability of the system is slightly insufficient. At present, the methods in this field are mostly based on fixed starting points or manual positioning, with an insufficient degree of automation. In this paper, a real-time robot localization and reconstruction system based on 3D vision is proposed, which includes pose estimation, environment reconstruction, and relocalization based on a 3D point cloud. First, a more accurate pose estimation method is applied for 3D environment reconstruction, using the coordinate transformation of the point cloud and the point cloud matching of the key frames. Then, a new point cloud segmentation method is proposed for local map maintenance to realize point cloud map display and human-robot interaction under real-time network transmission. Finally, a new robot relocalization method is proposed for map updating when the mapping is interrupted or repeated. The M2DGR dataset and real robot test were used to verify the accuracy and effect of the system, where the results showed that our method had a good performance.