Log files record computational events that reflect system state and behavior, making them a primary source of operational insights in modern computer systems. Automated anomaly detection on logs is therefore critical, yet most established methods rely on log parsers that collapse messages into discrete templates, discarding variable values and semantic content. We propose ContraLog, a parser-free and self-supervised method that reframes log anomaly detection as predicting continuous message embeddings rather than discrete template IDs. ContraLog combines a message encoder that produces rich embeddings for individual log messages with a sequence encoder to model temporal dependencies within sequences. The model is trained with a combination of masked language modeling and contrastive learning to predict masked message embeddings based on the surrounding context. Experiments on the HDFS, BGL, and Thunderbird benchmark datasets empirically demonstrate effectiveness on complex datasets with diverse log messages. Additionally, we find that message embeddings generated by ContraLog carry meaningful information and are predictive of anomalies even without sequence context. These results highlight embedding-level prediction as an approach for log anomaly detection, with potential applicability to other event sequences.

翻译：日志文件记录了反映系统状态与行为的计算事件，使其成为现代计算机系统中获取运行洞察的主要来源。因此，日志的自动化异常检测至关重要，然而现有方法大多依赖于日志解析器，这些解析器将消息压缩为离散模板，丢弃了变量值与语义内容。本文提出ContraLog，一种无需解析器且自监督的方法，将日志异常检测重新定义为预测连续消息嵌入而非离散模板ID。ContraLog结合了为单个日志消息生成丰富嵌入的消息编码器，以及用于建模序列内时序依赖的序列编码器。该模型通过结合掩码语言建模与对比学习进行训练，以基于上下文预测被掩码的消息嵌入。在HDFS、BGL和Thunderbird基准数据集上的实验，实证了该方法在具有多样化日志消息的复杂数据集上的有效性。此外，我们发现ContraLog生成的消息嵌入携带了有意义的信息，即使在没有序列上下文的情况下也能预测异常。这些结果凸显了嵌入级预测作为日志异常检测的一种方法，并具有扩展到其他事件序列的潜在适用性。