Page 146 - 《软件学报》2026年第7期

软件学报 ISSN 1000-9825, CODEN RUXUEW E-mail: jos@iscas.ac.cn
2026,37(7):2831−2848 [doi: 10.13328/j.cnki.jos.007585] [CSTR: 32375.14.jos.007585] http://www.jos.org.cn
©中国科学院软件研究所版权所有. Tel: +86-10-62562563

*
PCLog: 近端策略优化与行为克隆自适应日志异常检测

周俊伟, 胡 淼, 王春龙, 杜亚娟, 谈 诚

(武汉理工大学 计算机与人工智能学院, 湖北 武汉 430070)
通信作者: 周俊伟, E-mail: junweizhou@msn.com

摘 要: 日志数据记录了系统的运行状态、用户行为及错误信息. 基于日志的异常检测可快速识别潜在的安全风
险或性能瓶颈, 提升运维效率, 助力故障诊断. 然而, 现有的日志异常检测方法仍面临诸多挑战, 如无法有效适应系
统升级引起的日志模式变化, 缺乏高效反馈机制导致难以持续保持检测性能等. 为此, 提出一种日志异常检测框架
PCLog, 采用强化学习方法中的近端策略优化 (proximal policy optimization, PPO) 算法进行模型训练. 该方案将检
测模型视为智能体, 日志对应的语义向量视为状态, 事件视为动作, 通过最大化正常序列的累计奖励来学习系统的
正常行为模式从而实现异常检测. 此外, 当检测性能下降时, PCLog 可通过收集错误预测的样本作为专家示范数据,
并结合模仿学习中的行为克隆方法, 最大化专家数据的对数似然, 从而使模型更有效地逼近专家行为, 实现模型的
自适应修正, 有效减少误报率, 提升系统长期运行的可靠性. 在 HDFS、BGL 与 OpenStack 这 3 大公开日志数据集
上的实验结果表明, PCLog 相较于现有方法表现更优, 具备较强的动态日志模式适应能力.
关键词: 日志异常检测; 近端策略优化; 行为克隆
中图法分类号: TP311

中文引用格式: 周俊伟, 胡淼, 王春龙, 杜亚娟, 谈诚. PCLog: 近端策略优化与行为克隆自适应日志异常检测. 软件学报, 2026,
37(7): 2831–2848. http://www.jos.org.cn/1000-9825/7585.htm
英文引用格式: Zhou JW, Hu M, Wang CL, Du YJ, Tan C. PCLog: Adaptive Log Anomaly Detection Based on Proximal Policy
Optimization and Behavior Cloning. Ruan Jian Xue Bao/Journal of Software, 2026, 37(7): 2831–2848 (in Chinese). http://www.jos.org.
cn/1000-9825/7585.htm

PCLog: Adaptive Log Anomaly Detection Based on Proximal Policy Optimization and
Behavior Cloning
ZHOU Jun-Wei, HU Miao, WANG Chun-Long, DU Ya-Juan, TAN Cheng
(School of Computer Science and Artificial Intelligence, Wuhan University of Technology, Wuhan 430070, China)
Abstract: Log data record system operating status, user behavior, and error information. Log-based anomaly detection enables the rapid
identification of potential security risks or performance bottlenecks, thereby enhancing operational efficiency and facilitating fault diagnosis.
However, existing log anomaly detection methods still face several challenges, including the inability to effectively adapt to log pattern
changes caused by system updates and the lack of efficient feedback mechanisms to consistently maintain detection performance. To
address these issues, this study proposes a log anomaly detection framework, PCLog, which adopts the proximal policy optimization (PPO)
algorithm from reinforcement learning for model training. In the proposed framework, the detection model is formulated as an agent,
semantic vectors of logs are regarded as states, and events are treated as actions. By maximizing the cumulative rewards of normal
sequences, normal system behavior patterns are learned to enable anomaly detection. In addition, when detection performance decreases,
PCLog collects mispredicted samples as expert demonstration data and integrates behavior cloning from imitation learning to maximize the

* 基金项目: 湖北省重点研发基金 (2025BEB012)
本文由“智能化基础软件可信构造和供应链安全”专题特约编辑王林章教授、司徒凌云研究员、钟浩研究员、 向剑文教授、张路教授
推荐.
收稿时间: 2025-09-07; 修改时间: 2025-10-20; 采用时间: 2025-12-08; jos 在线出版时间: 2025-12-26
CNKI 网络首发时间: 2026-06-02