  Numerous DL-based approaches have garnered considerable attention in the
field of software Log Anomaly Detection. However, a practical challenge
persists: the class imbalance in the public data commonly used to train the DL
models. This imbalance is characterized by a substantial disparity in the
number of abnormal log sequences compared to normal ones, for example,
anomalies represent less than 1% of one of the most popular datasets. Previous
research has indicated that existing DLLAD approaches may exhibit
unsatisfactory performance, particularly when confronted with datasets
featuring severe class imbalances. Mitigating class imbalance through data
resampling has proven effective for other software engineering tasks, however,
it has been unexplored for LAD thus far. This study aims to fill this gap by
providing an in-depth analysis of the impact of diverse data resampling methods
on existing DLLAD approaches from two distinct perspectives. Firstly, we assess
the performance of these DLLAD approaches across three datasets and explore the
impact of resampling ratios of normal to abnormal data on ten data resampling
methods. Secondly, we evaluate the effectiveness of the data resampling methods
when utilizing optimal resampling ratios of normal to abnormal data. Our
findings indicate that oversampling methods generally outperform undersampling
and hybrid methods. Data resampling on raw data yields superior results
compared to data resampling in the feature space. In most cases, certain
undersampling and hybrid methods show limited effectiveness. Additionally, by
exploring the resampling ratio of normal to abnormal data, we suggest
generating more data for minority classes through oversampling while removing
less data from majority classes through undersampling. In conclusion, our study
provides valuable insights into the intricate relationship between data
resampling methods and DLLAD.
