PCLog: Adaptive Log Anomaly Detection Based on Proximal Policy Optimization and Behavior Cloning
Author:
Affiliation:

Clc Number:

TP311

Fund Project:

  • Article
  • |
  • Figures
  • |
  • Metrics
  • |
  • Reference
  • |
  • Related
  • |
  • Cited by
  • |
  • Materials
  • |
  • Comments
    Abstract:

    Log data record system operating status, user behavior, and error information. Log-based anomaly detection enables the rapid identification of potential security risks or performance bottlenecks, thereby enhancing operational efficiency and facilitating fault diagnosis. However, existing log anomaly detection methods still face several challenges, including the inability to effectively adapt to log pattern changes caused by system updates and the lack of efficient feedback mechanisms to consistently maintain detection performance. To address these issues, this study proposes a log anomaly detection framework, PCLog, which adopts the proximal policy optimization (PPO) algorithm from reinforcement learning for model training. In the proposed framework, the detection model is formulated as an agent, semantic vectors of logs are regarded as states, and events are treated as actions. By maximizing the cumulative rewards of normal sequences, normal system behavior patterns are learned to enable anomaly detection. In addition, when detection performance decreases, PCLog collects mispredicted samples as expert demonstration data and integrates behavior cloning from imitation learning to maximize the log-likelihood of expert data. This mechanism enables the model to more effectively approximate expert behavior, achieve adaptive self-correction, reduce false positives, and enhance long-term reliability. Experimental results on three public log datasets, HDFS, BGL, and OpenStack, show that PCLog outperforms existing methods and exhibits high adaptability to dynamic log patterns.

    Reference
    Related
    Cited by
Get Citation

周俊伟,胡淼,王春龙,杜亚娟,谈诚. PCLog: 近端策略优化与行为克隆自适应日志异常检测.软件学报,2026,37(7):2831-2848

Copy
Share
Article Metrics
  • Abstract:
  • PDF:
  • HTML:
  • Cited by:
History
  • Received:September 07,2025
  • Revised:October 20,2025
  • Adopted:
  • Online: December 26,2025
  • Published: July 06,2026
You are the firstVisitors
Copyright: Institute of Software, Chinese Academy of Sciences Beijing ICP No. 05046678-4
Address:4# South Fourth Street, Zhong Guan Cun, Beijing 100190,Postal Code:100190
Phone:010-62562563 Fax:010-62562533 Email:jos@iscas.ac.cn
Technical Support:Beijing Qinyun Technology Development Co., Ltd.

Beijing Public Network Security No. 11040202500063