# LogBD: A Log Anomaly Detection Method Based on Pretrained Models and Domain Adaptation
###### Abstract  
The log data generated during operation of a software system contain information about the system, and using logs for anomaly detection can detect system failures in a timely manner. Most existing log anomaly detection methods are specific to a particular system, have cold-start problems, and are sensitive to updates in log format. In this paper, we propose a log anomaly detection method LogBD based on pretrained models and domain adaptation, which uses the pretraining model BERT to learn the semantic information of logs. This method can solve problems caused by the multiple meaning of words and log statement updates. The distance to determine anomalies in LogBD is constructed on the basis of domain adaptation, using TCNs to extract common features of different system logs and mapping them to the same hypersphere space. Lastly, experiments were conducted on two publicly available datasets to evaluate the method. The experimental results showed that the method can better solve the log instability problem and exhibits some improvement in the cross-system log anomaly detection effect. log anomaly detection; pretrained models; domain adaptation +
Footnote †: journal:  
Maintaining and ensuring the availability of the entire system are the responsibilities of the operation and maintenance staff. In the face of increasing software reliability requirements, early operation and maintenance work is carried out manually. In the era of rapid expansion of Internet businesses and rising labor costs, traditional manual operation and maintenance have been unsustainable and cannot keep up with the rapid development of the Internet [3]. Therefore, automated operation and maintenance activities are essential. This approach mainly uses scripts that can predefine rules and automatically trigger [4] routine and repetitive operation and maintenance tasks, thereby reducing operation and maintenance costs and improving operation and maintenance efficiency. Automatic operation and maintenance activities utilize expert systems based on industry, as well as knowledge of the operation and maintenance scene. With the rapid growth of Internet business scope and the diversification of service types, expert systems based on manually specified rules cannot meet the demand. The emergence of DevOps partly solves this problem, but it pays more attention to the global perspective. Artificial intelligent operation and maintenance (AIOps) is an advanced implementation of DevOps in operation and maintenance. The concept of AIOps was proposed by Gartner in 2016 [5]. The goal of AIOps is to solve the problems of inefficiency, poor accuracy, and lack of automation in traditional IT operations. It is based on data management, algorithm, and scene-driven elements, combined with big data and machine learning technology. Data analysis in AIOps is no longer limited to the scope of the data itself, but includes mining specific patterns to predict possible events or diagnose the root cause of the current system behavior. AIOps enables operators to take actions and solve problems more intelligently. One of the focuses of AIOps is fault detection [6]. Logs play an indispensable role in fault detection. Log files are among the primary methods for recording operational status in IT domains such as operating systems. They are an important resource for identifying whether a system is in a healthy state, containing a wealth of system information. System developers and operations and maintenance personnel often use log data to view system status, find system failures, and locate root causes. The rich information hidden provides a good perspective for analyzing software system problems. Therefore, mining log information in large amounts of log data can help enhance system health, stability, and availability, and help operations and maintenance personnel to find abnormalities in system operation status.