###### Abstract  
Detailed information on system operation is recorded by system logs, from which fast and accurate detection of anomalies is conductive to service management and system maintenance. Log anomaly detection methods often only handle a single type of anomaly, and the utilization of log messages could be higher, which makes it challenging to improve the performance of log anomaly detection models. This article presents the LTAnomaly model to accomplish log anomaly detection using semantic information, sequence relationships, and component values to make a vector representation of logs, and we add Transformer with long short-term memory (LSTM) as our final classification model. When sequences are processed sequentially, the model is also influenced by the information from the global information, thus increasing the dependence on feature information. This improves the utilization of log messages with a flexible, simple, and robust model. To evaluate the effectiveness of our method, experiments are performed on the HDFS and BGL datasets, with the F1-measures reaching 0.985 and 0.975, respectively, showing that the proposed method enjoys higher accuracy and a more comprehensive application range than existing models. anomaly detection; deep learning; log analysis +
Footnote †: journal:  
detection. Log anomaly detection can represent logs by counting log events [5; 6; 7; 8] or capturing log event semantic information [2; 9] using support vector machine (SVM) [7; 10], principal component analysis (PCA) [5], invariant mining (IM) [6], long short-term memory (LSTM) [8; 11], and Transformer [12] for anomaly detection. However, these solutions also have the following problems. For example, SVM [7; 10] requires log mass tagging. PCA [5] is prone to false positives. Only log sequence exceptions can be detected by IM [6]. DeepLog [8] only takes into account one type of exception. LogRobust [9] and HitAnomaly [12] have high computing costs. DeepSyslog [13] does not consider the potential dangers caused by abnormal component values. To solve the above problems, we designed a log anomaly detection model, LTAnomaly, which uses LSTM and Transformer structures to model log semantic information, sequence relationships, and component information. In order to analyze logs more accurately, Word2 Vec generates word vectors, and term frequency-inverse document frequency (TF-IDF) supplies weighted feature vectors of log sequences and component values. This method fully uses the potential relationships between semantic information, temporal information, and other features and solves the problem of high abnormal false alarm rates caused by potential information omissions. Both features are combined and fed to LTAnomaly for further detection. The Transformer embedded with LSTM has strong generalization and low time consumption. The primary objective of this article is to enhance the efficiency of system anomaly detection by improving the quality of automated services. In order to achieve this, innovative deep learning techniques are employed to improve the ability to detect anomalies in system logs, enabling accurate and swift prediction of abnormalities and defects in advance. This approach satisfies the demands for timely, efficient, and precise security detection in real-world scenarios. The main contributions of this article are as follows:  
1. This paper presents a novel log representation considering component values. This approach precisely collects the component value information of the log and the semantic information captured on the log sequence. The potential relationships of multiple features are fully considered, improving the utilization of log information and anomaly detection accuracy. 2. This paper proposes LTAnomaly, a model for log anomaly detection based on LSTM and Transformer. LTAnomaly models the temporal dimension through LSTM and captures global contextual information using the attention mechanism in Transformer.