Research on Online Log Anomaly Detection Model Based on Informer

Abstract

To address the limitations of conventional reactive log anomaly detection in high-availability systems, this paper presents OADS—an online anomaly detection system that synergizes time-series prediction with real-time detection. The system features LSP-Informer, a multivariate log sequence predictor built upon Informer architecture and enhanced by a novel weighted combination loss (WCL) that simultaneously optimizes both prediction accuracy and semantic consistency. Furthermore, OADS implements a unique prediction-detection cascade by integrating LSP-Informer with a Temporal Convolutional Network + Attention (TCNA)-based Log Anomaly Detection Model (LADM), enabling proactive anomaly forecasting 5–10 steps ahead. Experimental results on HDFS logs demonstrate exceptional performance: The TCNA-based LADM achieves an F1-score of 0.9860, while LSP-Informer maintains a 0.9801 F1-score for 5-step-ahead prediction. The complete OADS system successfully predicts potential anomalies in advance, maintaining a robust 0.73+ Jaccard index under heavy masking conditions while preserving interpretability in real-world deployments.