The Sub-Sequence Summary Method for detecting anomalies in logs

This paper introduces a novel method for detecting log anomalies using deep learning. Unlike state-of-the-art methods that rely on sequence models such as LSTMs or Transformers, our approach does not require an appropriate representation of subsequent log lines to be fed into the model. Instead, we extract specific features from the log sequence, and derive anomaly scores from the reconstruction loss of an ordinary auto-encoder. These features are easy to obtain, contain sequential information, and allow for the integration of numerical attributes from log lines. We present two variants: a template-based method and a fully semantic-based method.