[EricssonLG Summer Internship] Log Anomaly Detection

보안상의 이유로 코드 공개가 불가합니다.

1. Overview

• purpose: Designing an AI model to detect potential anomalies in design from logs.

• background: vDU has a working AI model (Cell Setup, ESS Cell Setup, Carrier Setup)
  

  

2. Result

The following table illustrates the performance of the model. These particular results show that when I used a combination of two models, which were the Long Short Term Memory Model and the Isolation Forest Model, the accuracy of the model was 99, the precision was 78, the recall was 100, and the f1-score was 88.

3. Procedure

1. Long Short Term Memory Model
   LSTM model is suitable for ordered data, such as time series data or sentences. LSTM model use MSE values to express how different the next predictive message is from the actual message.

2. Isolation Forest Model
   Model training is possible with only normal data. Isolation Forest Model classifies as normal if prediction is 1 and abnormal if prediction is -1.

4. Model Parameter Control

• LSTM Model
  • mse_test: average of the squared values of the error between the predicted log message by and the actual log message.
• Isolation Forest Model
  • contamination: percentage of outliers expected in the overall data.
  • c_esimators: number of iTree

Why I choose case 2?

• Isolation forest model leaves only a proportion of contamination in the entire dataset (high risk of anomaly being filtered).
• Considering the overall performance (ex. Precision, Recall, F1-Score) of both cases, the optimal model for implementing a log anomaly detection feature consists of utilizing the LSTM model and Isolation Forest model in the particular order.

5. Use Case

• Detect potential product flaws before release.
• More work needs to be done for analyzing LTTNG logs.

Presentation in Seoul Technical Stand-up, EricssonLG

Playing the Demo code