# LogBD: A Log Anomaly Detection Method Based on Pretrained Models and Domain Adaptation
## 5 Conclusions  
Aiming at the problems existing in the current log anomaly detection methods, this paper proposed a cross-system log anomaly detection method LogBD based on domain adaptation. This method establishes an adversarial training framework based on the adversarial domain adaptive network, uses the pretraining model BERT to extract the semantic information of the log statement, uses the TCN to learn the order relationship of the log sequence, and maps the log sequence from the two systems to the hypersphere space, so that they are close to its center. On the basis of the distance between the log sequence and the center of the sphere, the anomaly is judged, and the distribution of the  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Domain** & \multicolumn{2}{c}{**Source**} & \multicolumn{2}{c}{**Target**} \\ \cline{2-5}
**Adaptation** & \(\mathbf{F_{1}}\) & **AUC** & \(\mathbf{F_{1}}\) & **AUC** \\ \hline Without & 0.647 & 0.872 & 0.592 & 0.628 \\ With (ours) & **0.933** & **0.978** & **0.841** & **0.854** \\ \hline \hline \end{tabular}
\end{table}
Table 10: BGL-TB scenario using or not using domain adaptation method.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Domain** & \multicolumn{2}{c}{**Source**} & \multicolumn{2}{c}{**Target**} \\ \cline{2-5}
**Adaptation** & \(\mathbf{F_{1}}\) & **AUC** & \(\mathbf{F_{1}}\) & **AUC** \\ \hline Without & 0.794 & 0.807 & 0.467 & 0.418 \\ With (ours) & **0.880** & **0.880** & **0.938** & **0.973** \\ \hline \hline \end{tabular}
\end{table}
Table 9: TB-BGL scenario using or not using domain adaptation method.  
Figure 9: (**Left**) TB-BGL; (**right**) BGL-TB.  
domain is confused. At the same time, a good anomaly detection effect is obtained. Related experiments of LogBD were designed and carried out. The experiments showed that the method achieved good results in cross-system log anomaly detection.  
In this paper, the log data were divided into log sequences through the sliding window mechanism; only the log template sequence was used for anomaly detection, whereas the parameter information in the log message was not used. The next research direction is to establish new anomaly detection schemes for some important parameters, such as delay anomaly for log interval. Although the log anomaly detection model in this paper considers cross-system anomaly detection, it can only realize anomaly detection on two systems, whereas it cannot be deployed on multiple different systems. The next research direction will be to continue to study multisystem log anomaly detection in the field of domain adaptation.  
Conceptualization, L.D. and S.L.; methodology, L.D.; software, L.D.; validation, L.D., H.X. and W.W.; formal analysis, L.D.; investigation, L.D.; resources, L.D.; data curation, L.D.; writing--original draft preparation, L.D.; writing--review and editing, L.D.; visualization, L.D.; supervision, L.D.; project administration, S.L.; funding acquisition, S.L. All authors have read and agreed to the published version of the manuscript.  
This research was funded by the National Nature Science Foundation of China, grant number 61762085, and the Autonomous Region Science and Technology Program of Xinjiang, grant 2020A02001-1.  
Not applicable.  
The data presented in this study are openly available from [26].  
The authors thank NSFC for funding this research, as well as the anonymous reviewers for their contribution to this paper.  
The authors declare no conflict of interest.