# PULL: Reactive Log Anomaly Detection Based On Iterative PU Learning

arXiv: https://arxiv.org/abs/2301.10681 · HTML: https://mlsanity.com/paper/2301.10681/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 11 of its 50 references that are in the map.
- First posted on arXiv 25 Jan 2023.

## Builds on (most cited first, 11 of 11)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [Convolutional Sequence to Sequence Learning](https://mlsanity.com/paper/1705.03122/) (2017)
- [Time Series Data Augmentation for Deep Learning: A Survey](https://mlsanity.com/paper/2002.12478/) (2020)
- [Learning from positive and unlabeled data: a survey](https://mlsanity.com/paper/1811.04820/) (2018)
- [Text Classification Algorithms: A Survey](https://mlsanity.com/paper/1904.08067/) (2019)
- [LogBERT: Log Anomaly Detection via BERT](https://mlsanity.com/paper/2103.04475/) (2021)
- [Self-Attentive Classification-Based Anomaly Detection in Unstructured Logs](https://mlsanity.com/paper/2008.09340/) (2020)
- [A2Log: Attentive Augmented Log Anomaly Detection](https://mlsanity.com/paper/2109.09537/) (2021)
- [LogLAB: Attention-Based Labeling of Log Data Anomalies via Weak Supervision](https://mlsanity.com/paper/2111.01657/) (2021)
- [A Taxonomy of Anomalies in Log Data](https://mlsanity.com/paper/2111.13462/) (2021)

## Built on by (most cited first, 3 of 3)

- [LogRCA: Log-based Root Cause Analysis for Distributed Services](https://mlsanity.com/paper/2405.13599/) (2024)
- [AIOps-Driven Enhancement of Log Anomaly Detection in Unsupervised Scenarios](https://mlsanity.com/paper/2311.02621/) (2023)
- [Progressing from Anomaly Detection to Automated Log Labeling and Pioneering Root Cause Analysis](https://mlsanity.com/paper/2312.14748/) (2023)

## Abstract (arXiv)

Due to the complexity of modern IT services, failures can be manifold, occur at any stage, and are hard to detect. For this reason, anomaly detection applied to monitoring data such as logs allows gaining relevant insights to improve IT services steadily and eradicate failures. However, existing anomaly detection methods that provide high accuracy often rely on labeled training data, which are time-consuming to obtain in practice. Therefore, we propose PULL, an iterative log analysis method for reactive anomaly detection based on estimated failure time windows provided by monitoring systems instead of labeled data. Our attention-based model uses a novel objective function for weak supervision deep learning that accounts for imbalanced data and applies an iterative learning strategy for positive and unknown samples (PU learning) to identify anomalous logs. Our evaluation shows that PULL consistently outperforms ten benchmark baselines across three different datasets and detects anomalous log messages with an F1-score of more than 0.99 even within imprecise failure time windows.