Abstract:To improve service availability, software systems usually record runtime logs and detect anomalies based on these logs. Most existing log-based anomaly detection approaches rely on log parsing to construct structured model inputs. However, log-parsing-based anomaly detection methods are prone to two critical issues, namely extraction effectiveness and parsing mismatch. To address these problems, this study proposes a novel parser-free log-based anomaly detection method, named IncreBERT. In IncreBERT, logs are first preprocessed, and a BERT encoder with incremental pre-training is employed to extract semantic information from log entries. Subsequently, the maximum pooler is applied to obtain session-level semantic features. Finally, a fully connected layer is used to generate the final anomaly detection results. For performance evaluation, IncreBERT is compared with six baseline methods—DeepLog, LogAnomaly, LogRobust, PLELog, NeuralLog, and LogBERT—on three benchmark datasets. Experimental results demonstrate that IncreBERT achieves an average performance improvement of 10.17% over state-of-the-art log-based anomaly detection methods.