Anomaly detection and diagnosis in ASML event log using attentional LSTM network

Abstract

In the ASML test system, all activity events of the test are continuously recorded in event logs, and these logs are intended to help people diagnose the root cause of a failure. However, due to the large scale of the logs, manual inspection of these logs consumes lots of effort and time, and the lack of expert knowledge of engineers makes the efficient diagnosis more difficult. To improve the failure diagnosis efficiency in ASML, this paper proposes an attentional long-short term neural network into log sequence analysis. The LSTM neural network extracts the underlying dependencies in the event log and an attention layer is appended after to measure the importance of earlier events on the prediction of future events. The model learns the normal patterns from a large number of event logs from successful tests and detects deviations from normal patterns as anomalies. The likelihood of being abnormal of an event is measured by how far it deviates from the prediction. And the prediction process of the model can be understood by visualizing the attention scores of earlier events when the model makes decisions. Moreover, a visualization tool is built to illustrate the locations of anomalies and interpret the causes of anomalies through the attention maps.