# LogLAB: Attention-Based Labeling of Log Data Anomalies via Weak Supervision

arXiv: https://arxiv.org/abs/2111.01657 · HTML: https://mlsanity.com/paper/2111.01657/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 31 references that are in the map.
- First posted on arXiv 2 Nov 2021.

## Builds on (most cited first, 7 of 7)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [Data Programming: Creating Large Training Sets, Quickly](https://mlsanity.com/paper/1605.07723/) (2016)
- [Text Classification Algorithms: A Survey](https://mlsanity.com/paper/1904.08067/) (2019)
- [Self-Attentive Classification-Based Anomaly Detection in Unstructured Logs](https://mlsanity.com/paper/2008.09340/) (2020)
- [A2Log: Attentive Augmented Log Anomaly Detection](https://mlsanity.com/paper/2109.09537/) (2021)
- [Decentralized Federated Learning Preserves Model and Data Privacy](https://mlsanity.com/paper/2102.00880/) (2021)

## Built on by (most cited first, 6 of 6)

- [LogLG: Weakly Supervised Log Anomaly Detection via Log-Event Graph Construction](https://mlsanity.com/paper/2208.10833/) (2022)
- [TransLog: A Unified Transformer-based Framework for Log Anomaly Detection](https://mlsanity.com/paper/2201.00016/) (2021)
- [A Taxonomy of Anomalies in Log Data](https://mlsanity.com/paper/2111.13462/) (2021)
- [PULL: Reactive Log Anomaly Detection Based On Iterative PU Learning](https://mlsanity.com/paper/2301.10681/) (2023)
- [LogRCA: Log-based Root Cause Analysis for Distributed Services](https://mlsanity.com/paper/2405.13599/) (2024)
- [Progressing from Anomaly Detection to Automated Log Labeling and Pioneering Root Cause Analysis](https://mlsanity.com/paper/2312.14748/) (2023)

## Abstract (arXiv)

With increasing scale and complexity of cloud operations, automated detection of anomalies in monitoring data such as logs will be an essential part of managing future IT infrastructures. However, many methods based on artificial intelligence, such as supervised deep learning models, require large amounts of labeled training data to perform well. In practice, this data is rarely available because labeling log data is expensive, time-consuming, and requires a deep understanding of the underlying system. We present LogLAB, a novel modeling approach for automated labeling of log messages without requiring manual work by experts. Our method relies on estimated failure time windows provided by monitoring systems to produce precise labeled datasets in retrospect. It is based on the attention mechanism and uses a custom objective function for weak supervision deep learning techniques that accounts for imbalanced data. Our evaluation shows that LogLAB consistently outperforms nine benchmark approaches across three different datasets and maintains an F1-score of more than 0.98 even at large failure time windows.