DeepLog

The DeepLog class uses the torch-train library for training and prediction. This class implements the neural network as described in the paper Deeplog: Anomaly detection and diagnosis from system logs through deep learning.

class deeplog.DeepLog(*args: Any, **kwargs: Any)

Initialization

DeepLog.__init__(input_size, hidden_size, output_size, num_layers=2)

DeepLog model used for training and predicting logs.

Parameters

• input_size (int) – Dimension of input layer.

• hidden_size (int) – Dimension of hidden layer.

• output_size (int) – Dimension of output layer.

• num_layers (int, default=2) – Number of hidden layers, i.e. stacked LSTM modules.

Forward

As DeepLog is a Neural Network, it implements the forward() method which passes input through the entire network.

DeepLog.forward(X)

Forward sample through DeepLog.

Parameters

X (tensor) – Input to forward through DeepLog network.

Returns

result

Return type

tensor

Fit

DeepLog inherits its fit method from the torch-train module. See the documentation for a complete reference.

DeepLog.fit(X, y, epochs=10, batch_size=32, learning_rate=0.01, criterion=torch.nn.NLLLoss, optimizer=torch.optim.SGD, variable=False, verbose=True, **kwargs)

Train the module with given parameters

Parameters

• X (torch.Tensor) – Tensor to train with

• y (torch.Tensor) – Target tensor

• epochs (int, default=10) – Number of epochs to train with

• batch_size (int, default=32) – Default batch size to use for training

• learning_rate (float, default=0.01) – Learning rate to use for optimizer

• criterion (nn.Loss, default=nn.NLLLoss) – Loss function to use

• optimizer (optim.Optimizer, default=optim.SGD) – Optimizer to use for training

• variable (boolean, default=False) – If True, accept inputs of variable length

• verbose (boolean, default=True) – If True, prints training progress

Returns

result – Returns self

Return type

self

Predict

The regular network gives a probability distribution over all possible output values. However, DeepLog outputs the k most likely outputs, therefore it overwrites the predict() method of the Module class from torch-train.

DeepLog.predict(X, y=None, k=1, variable=False, verbose=True)

Predict the k most likely output values

Parameters

• X (torch.Tensor of shape=(n_samples, seq_len)) – Input of sequences, these will be one-hot encoded to an array of shape=(n_samples, seq_len, input_size)

• y (Ignored) – Ignored

• k (int, default=1) – Number of output items to generate

• variable (boolean, default=False) – If True, predict inputs of different sequence lengths

• verbose (boolean, default=True) – If True, print output

Returns

• result (torch.Tensor of shape=(n_samples, k)) – k most likely outputs

• confidence (torch.Tensor of shape=(n_samples, k)) – Confidence levels for each output