# LogBD: A Log Anomaly Detection Method Based on Pretrained Models and Domain Adaptation
## 2 Related Work
### Anomaly Detection  
The existing anomaly detection methods based on log data are mainly rule-based, graph-based, and machine learning-based detection methods [12]. Rule-based log anomaly detection methods use the frequency of keywords appearing in logs, combine domain knowledge, and design relevant regular expressions to mine potential information in log data. Graph-based anomaly detection uses the contextual relationships of log sequences to model and construct a request execution logic graph. Currently, machine learning-based methods include traditional machine learning methods and deep learning methods, which mainly use neural network models to infer whether logs are abnormal by judging log sequence relationships. Among the traditional machine learning methods, [PERSON] et al., constructed a log anomaly detection method based on principal component analysis (PCA) [13], which constructs log feature vectors from the state ratio vectors and event count vectors during system execution, and combines PCA with term weighting techniques in the field of data retrieval, which can discover patterns between event count vectors. [PERSON] et al., proposed a decision tree based detection method [14], which uses decision trees to handle discrete and continuous attributes to perform anomaly detection by analyzing server request sequences. [PERSON] proposed LogClass [15], which uses a data-driven approach to detect and classify anomalies in logs. First, the raw log data are preprocessed to generate a bag-of-words model description approach. Then, positive and unlabeled (PU) learning methods and support vector machines are used to train anomaly detection and classification models. Lastly, anomaly detection is performed on logs. [PERSON] et al., proposed invariant mining (IM) to mine information in log data [16], which mines invariants from console logs using a strong search algorithm, and then detects system anomalies if the appearance of a new log sequence breaks an invariant during the life cycle of system execution. [PERSON] et al., proposed logcluster [17], a log clustering-based problem identification method that uses hierarchical clustering techniques to aggregate similar log sequences into clusters for automatic problem identification. As the size of log data increases, more human and material resources are required for feature engineering, and the cost of traditional machine learning methods increases greatly. Many scholars have applied deep learning methods to log anomaly detection. [PERSON] et al., proposed DeepLog [18], a deep learning model based on a long short-term memory network (LSTM), which was the first to use deep learning for detecting log data sequences that constructs log sequences as time series to achieve the anomaly detection of log templatesequences and parameter values. [PERSON] et al., designed a vectorized representation of templates inspired by word embedding, template2 Vec; they proposed LogAnomaly [19], an anomaly detection framework for unstructured log streams. [PERSON] et al., proposed the LogRobust model [20], which uses the semantic encoding method FastText to extract log semantic information and represent it as a semantic vector for the unstable characteristics of logs, learns semantic information, and detects anomalies through the BiLSTM model, which can categorize log events as semantic approximations when logs are updated, solving the instability of log events caused by log updates, etc. [PERSON] et al., used generative adversarial networks based on LSTM of system logs using permutation event modeling to detect anomalies, called LogGAN [21], to detect log-level anomalies on the basis of patterns. The permutation event modeling mitigates the strong sequential features in LSTM and solves the problem of misordering caused by the late arrival of logs. Generating adversarial networks mitigates the effect of imbalance between normal and abnormal data and improves anomaly detection.