An Empirical Study of a PCA-Based Multivariate Framework for Interpretable Log Anomaly Detection

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F63839172%3A_____%2F25%3A10133839" target="_blank" >RIV/63839172:_____/25:10133839 - isvavai.cz</a>

Nalezeny alternativní kódy

RIV/00216305:26230/26:0198980

Výsledek na webu

<a href="http://dx.doi.org/10.23919/CNSM67658.2025.11297507" target="_blank" >http://dx.doi.org/10.23919/CNSM67658.2025.11297507</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.23919/CNSM67658.2025.11297507" target="_blank" >10.23919/CNSM67658.2025.11297507</a>

Jazyk výsledku

angličtina

Název v původním jazyce

An Empirical Study of a PCA-Based Multivariate Framework for Interpretable Log Anomaly Detection

Popis výsledku v původním jazyce

Effective anomaly detection is crucial for increasingly complex system logs, yet current methods often face challenges with labeled data reliance, high computational costs, or limited interpretability. This paper empirically applies an established Multivariate Statistical Network Monitoring (MSNM) framework, which leverages Principal Component Analysis (PCA) with D and Q statistics, to the log anomaly detection domain. We evaluate its performance on three benchmark datasets (HDFS, BGL, Thunderbird), focusing on its semi-supervised nature (requiring only normal operational data), computational efficiency, interpretability via count vector feature contributions, and ease of deployment. Our results demonstrate competitive F1 scores comparable to some supervised and deep learning methods, maintaining low computational overhead without GPU dependency. Furthermore, its strong interpretability is showcased through case studies, identifying specific log event patterns causing anomalies. This study highlights the MSNM framework&apos;s potential as a practical, efficient, and interpretable solution for log anomaly detection.

Název v anglickém jazyce

An Empirical Study of a PCA-Based Multivariate Framework for Interpretable Log Anomaly Detection

Popis výsledku anglicky

Effective anomaly detection is crucial for increasingly complex system logs, yet current methods often face challenges with labeled data reliance, high computational costs, or limited interpretability. This paper empirically applies an established Multivariate Statistical Network Monitoring (MSNM) framework, which leverages Principal Component Analysis (PCA) with D and Q statistics, to the log anomaly detection domain. We evaluate its performance on three benchmark datasets (HDFS, BGL, Thunderbird), focusing on its semi-supervised nature (requiring only normal operational data), computational efficiency, interpretability via count vector feature contributions, and ease of deployment. Our results demonstrate competitive F1 scores comparable to some supervised and deep learning methods, maintaining low computational overhead without GPU dependency. Furthermore, its strong interpretability is showcased through case studies, identifying specific log event patterns causing anomalies. This study highlights the MSNM framework&apos;s potential as a practical, efficient, and interpretable solution for log anomaly detection.

Druh

D - Stať ve sborníku

CEP obor

—

OECD FORD obor

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Projekt

<a href="/cs/project/LM2023054" target="_blank" >LM2023054: e-Infrastruktura CZ</a><br>

Návaznosti

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Rok uplatnění

2025

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název statě ve sborníku

Proceedings of the 2025 21st International Conference on Network and Service Management (CNSM)

ISBN

978-3-903176-75-1

ISSN

2165-963X

e-ISSN

—

Počet stran výsledku

6

Strana od-do

—

Název nakladatele

IEEE

Místo vydání

NEW YORK

Místo konání akce

Bologna, Italy

Datum konání akce

27. 10. 2025

Typ akce podle státní příslušnosti

WRD - Celosvětová akce

Kód UT WoS článku

—