The authors tackle anomaly detection in system logs when you only have coarse labels (e.g., "this batch of logs contains an anomaly somewhere") rather than labels on individual log entries. Their LogMILP framework uses multi-instance learning — treating a bag of logs as the unit of supervision — combined with prototype-guided modeling and counterfactual perturbations to identify which specific log entries are anomalous. This lets operators pinpoint the exact problematic events without expensive instance-level annotations.
Main takeaways:
- Trains on bag-level labels ("anomaly present in this collection") but produces instance-level localization ("line 47 is the culprit").
- Uses prototypes (representative examples) and counterfactual perturbations ("if I remove this entry, does the bag stop looking anomalous?") to guide the model to the critical log entries.
- Achieves competitive detection performance while improving localization reliability on three public log datasets.
- Code is open-sourced for practitioners working with large-scale networked systems.