Skip to main content

Lund University Publications

LUND UNIVERSITY LIBRARIES

ALogSCAN: A Self-Supervised Dual Network for Adaptive and Timely Log Anomaly Detection in Clouds

Raeiszadeh, Mahsa ; Estrada-Solano, Felipe ; Glitho, Roch ; Eker, Johan LU orcid and Mini, Raquel (2025) In IEEE Transactions on Cognitive Communications and Networking
Abstract
Logs are prevalent in modern cloud systems and serve as a valuable source of information for system maintenance. Over the years, many supervised, semi-supervised, and unsupervised log analysis methods have been proposed to detect system anomalies. In particular, semi-supervised methods have garnered increasing attention as they balance reduced labeled data requirements and optimal detection performance, contrasting with their supervised and unsupervised counterparts. However, existing semi-supervised log analysis methods often suffer from practical challenges, such as log instability, imbalanced class data, and labeling dependency, which are pervasive issues in real-world systems. To address these challenges, we propose ALogSCAN, a... (More)
Logs are prevalent in modern cloud systems and serve as a valuable source of information for system maintenance. Over the years, many supervised, semi-supervised, and unsupervised log analysis methods have been proposed to detect system anomalies. In particular, semi-supervised methods have garnered increasing attention as they balance reduced labeled data requirements and optimal detection performance, contrasting with their supervised and unsupervised counterparts. However, existing semi-supervised log analysis methods often suffer from practical challenges, such as log instability, imbalanced class data, and labeling dependency, which are pervasive issues in real-world systems. To address these challenges, we propose ALogSCAN, a self-supervised method to detect anomalies at the host level of cloud systems. ALogSCAN introduces the Dynamic Frequency-based Log Filtering (DFLF) technique to mitigate the potential bias introduced by highly frequent log messages, thereby focusing more on infrequent yet critical log messages. Moreover, the self-supervised nature of ALogSCAN eliminates the need for time-consuming manual labeling of log data, and enables the DFLF technique to continuously adapt to evolving log sequences, maintaining robustness against unstable log data. We have evaluated ALogSCAN on two widely used public datasets and one private dataset from Ericsson Research, and the experimental results demonstrate its effectiveness, consistently outperforming existing methods in various scenarios. (Less)
Please use this url to cite or link to this publication:
author
; ; ; and
organization
publishing date
type
Contribution to journal
publication status
published
subject
in
IEEE Transactions on Cognitive Communications and Networking
publisher
IEEE - Institute of Electrical and Electronics Engineers Inc.
ISSN
2332-7731
DOI
10.1109/TMLCN.2025.3594653
project
AORTA: Advanced Offloading for Real-Time Applications
language
English
LU publication?
yes
id
4486d51e-cabd-46f0-89b2-993e8761f0db
date added to LUP
2025-08-21 14:47:36
date last changed
2025-09-03 10:53:19
@article{4486d51e-cabd-46f0-89b2-993e8761f0db,
  abstract     = {{Logs are prevalent in modern cloud systems and serve as a valuable source of information for system maintenance. Over the years, many supervised, semi-supervised, and unsupervised log analysis methods have been proposed to detect system anomalies. In particular, semi-supervised methods have garnered increasing attention as they balance reduced labeled data requirements and optimal detection performance, contrasting with their supervised and unsupervised counterparts. However, existing semi-supervised log analysis methods often suffer from practical challenges, such as log instability, imbalanced class data, and labeling dependency, which are pervasive issues in real-world systems. To address these challenges, we propose ALogSCAN, a self-supervised method to detect anomalies at the host level of cloud systems. ALogSCAN introduces the Dynamic Frequency-based Log Filtering (DFLF) technique to mitigate the potential bias introduced by highly frequent log messages, thereby focusing more on infrequent yet critical log messages. Moreover, the self-supervised nature of ALogSCAN eliminates the need for time-consuming manual labeling of log data, and enables the DFLF technique to continuously adapt to evolving log sequences, maintaining robustness against unstable log data. We have evaluated ALogSCAN on two widely used public datasets and one private dataset from Ericsson Research, and the experimental results demonstrate its effectiveness, consistently outperforming existing methods in various scenarios.}},
  author       = {{Raeiszadeh, Mahsa and Estrada-Solano, Felipe and Glitho, Roch and Eker, Johan and Mini, Raquel}},
  issn         = {{2332-7731}},
  language     = {{eng}},
  month        = {{07}},
  publisher    = {{IEEE - Institute of Electrical and Electronics Engineers Inc.}},
  series       = {{IEEE Transactions on Cognitive Communications and Networking}},
  title        = {{ALogSCAN: A Self-Supervised Dual Network for Adaptive and Timely Log Anomaly Detection in Clouds}},
  url          = {{http://dx.doi.org/10.1109/TMLCN.2025.3594653}},
  doi          = {{10.1109/TMLCN.2025.3594653}},
  year         = {{2025}},
}