The DOI matches its Crossref record; 26 of the 26 references it cites were found in a registry or an index.
Self-Attentive Classification-Based Anomaly Detection in Unstructured Logs
Open accessAbstract
The detection of anomalies is an essential data mining task for achieving security and reliability in computer systems. Logs are a common and major data source for anomaly detection methods in almost every computer system. Recent studies have focused predominantly on one-class deep learning methods on manually specified log representations. The main limitation is that these models are not able to learn log representations describing the semantic differences between normal and anomaly logs, leading to a poor generalization on unseen logs. We propose Logsy, a classification-based method to learn log representations that allow to distinguish between normal system log data and anomaly samples from auxiliary log datasets, easily accessible via the internet. The idea behind such an approach to anomaly detection is that the auxiliary dataset is sufficiently informative to enhance the representation of the normal data, yet diverse to regularize against overfitting and improve generalization. We perform several experiments on publicly available datasets to evaluate the performance and properties, where we show improvement of 0.25 in F1 compared to previous methods.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“At present, it is evolving towards semantic alignment based on pre-trained language models [10],[11] .”
From A Survey of Anomaly Detection and Root Cause Analysis Techniques for Artificial Intelligence for IT Operations (AIOps) in Large-Scale Software Systems (2026) · cites this paper as [11]
Citations
Cites
Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, L., & Polosukhin, I. (2017) · arXiv · doi:10.48550/arxiv.1706.03762 · Cited by 120,404
BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding
Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2019) · Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers) · doi:10.18653/v1/n19-1423 · Cited by 54,325
Representation Learning: A Review and New Perspectives
Bengio, Y., Courville, A., & Vincent, P. (2013) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2013.50 · Cited by 13,001
Procedures for Detecting Outlying Observations in Samples
Grubbs, F. E. (1969) · Technometrics · doi:10.1080/00401706.1969.10490657 · Cited by 4,105
Loper, E., & Bird, S. (2002) · doi:10.3115/1118108.1118117 · Cited by 3,323
NLTK: The Natural Language ToolkitPreprint
Loper, E., & Bird, S. (2002) · arXiv (Cornell University) · doi:10.48550/arxiv.cs/0205028 · Cited by 1,893
DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning
Du, M., Li, F., Zheng, G., & Srikumar, V. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134015 · Cited by 1,835
Detecting large-scale system problems by mining console logs
Xu, W., Huang, L., Fox, A., Patterson, D., & Jordan, M. I. (2009) · Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles · doi:10.1145/1629575.1629587 · Cited by 1,332
Drain: an online log parsing approach with fixed depth tree
He, P., Zhu, J., Zheng, Z., & Lyu, M. R. (2017) · 2017 IEEE International Conference on Web Services (ICWS) · doi:10.1109/icws.2017.13 · Cited by 943
Robust log-based anomaly detection on unstable log data
Zhang, X., Xu, Y., Lin, Q., Qiao, B., Zhang, H., Dang, Y., Xie, C., Yang, X., Cheng, Q., Li, Z., et al. (2019) · Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering · doi:10.1145/3338906.3338931 · Cited by 761
LogAnomaly: Unsupervised Detection of Sequential and Quantitative Anomalies in Unstructured Logs
Meng, W., Liu, Y., Zhu, Y., Zhang, S., Pei, D., Liu, Y., Chen, Y., Zhang, R., Tao, S., Sun, P., et al. (2019) · Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/658 · Cited by 708
What Supercomputers Say: A Study of Five System Logs
Oliner, A. J., & Stearley, J. (2007) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn.2007.103 · Cited by 695
Tools and benchmarks for automated log parsing
Zhu, J., He, S., Liu, J., He, P., Xie, Q., Zheng, Z., & Lyu, M. R. (2019) · 2019 IEEE/ACM 41st International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip.2019.00021 · Cited by 574
Deep Semi-Supervised Anomaly Detection
Ruff, L., Vandermeulen, R. A., Görnitz, N., Binder, A., Müller, E., Müller, K.-R., & Kloft, M. (2019) · arXiv · doi:10.48550/arxiv.1906.02694 · Cited by 388
Mining invariants from console logs for system problem detection
Lou, J., Fu, Q., Yang, S., Xu, Y., & Li, J. (2010) · Cited by 301
Failure Prediction in IBM BlueGene/L Event Logs
Liang, Y., Zhang, Y., Xiong, H., & Sahoo, R. (2007) · Seventh IEEE International Conference on Data Mining (ICDM 2007) · doi:10.1109/icdm.2007.46 · Cited by 292
A Classification Framework for Anomaly Detection
Steinwart, I., Hush, D. R., & Scovel, C. (2005) · Cited by 268
One-class classifier networks for target recognition applications
Moya, M. M., Koch, M. W., & Hostetler, L. D. (1993) · NASA STI/Recon Technical Report N · Cited by 236
On nonparametric estimation of density level sets
Tsybakov, A. B. (1997) · The Annals of Statistics · doi:10.1214/aos/1069362732 · Cited by 209
Automated IT system failure prediction: A deep learning approach
Zhang, K., Xu, J., Min, M. R., Jiang, G., Pelechrinis, K., & Zhang, H. (2016) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata.2016.7840733 · Cited by 193
A Classification Framework for Anomaly Detection
SteinwartIngo, HushDon, & ScovelClint (2005) · Journal of Machine Learning Research · doi:10.5555/1046920.1058109 · Cited by 142
Long short-term memory based operation log anomaly detection
Vinayakumar, R., Soman, K. P., & Poornachandran, P. (2017) · International Conference on Advances in Computing, Communications and Informatics (ICACCI) · doi:10.1109/icacci.2017.8125846 · Cited by 111
Anomaly Detection from Log Files Using Data Mining Techniques
Breier, J., & Branišová, J. (2015) · Lecture notes in electrical engineering · doi:10.1007/978-3-662-46578-3_53 · Cited by 78
Nedelkoski, S., Bogatinovski, J., Acker, A., Cardoso, J., & Kao, O. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-67667-4_8 · Cited by 78
Self-citationCo-analysis of RAS Log and Job Log on Blue Gene/P
Zheng, Z., Yu, L., Tang, W., Lan, Z., Gupta, R., Desai, N., Coghlan, S., & Buettner, D. (2011) · IEEE International Parallel and Distributed Processing Symposium (IPDPS) · doi:10.1109/ipdps.2011.83 · Cited by 76
Rapid and robust impact assessment of software changes in large internet-based services
Zhang, S., Liu, Y., Pei, D., Chen, Y., Qu, X., Tao, S., & Zang, Z. (2015) · ACM International Conference on emerging Networking EXperiments and Technologies (CoNEXT) · doi:10.1145/2716281.2836087 · Cited by 56
Research works printed but not linked: 1
- 10.2307/1266761 · DOI
Cited by
Sorted by citations
A Unifying Review of Deep and Shallow Anomaly Detection
Ruff, L., Kauffmann, J., Vandermeulen, R. A., Montavon, G., Samek, W., Kloft, M., Dietterich, T. G., & Muller, K.-R. (2021) · Proceedings of the IEEE · doi:10.1109/jproc.2021.3052449 · Cited by 1,184
Log-based Anomaly Detection Without Log Parsing
Le, V.-H., & Zhang, H. (2021) · 2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase51524.2021.9678773 · Cited by 361
“[56] proposed Logsy, which is a classification-based method to learn log representations in a way to distinguish between normal data from the target system and anomaly samples from auxiliary log datasets.”
MethodLog-based anomaly detection with deep learning: how far are we?
Le, V.-H., & Zhang, H. (2022) · Proceedings of the 44th International Conference on Software Engineering · doi:10.1145/3510003.3510155 · Cited by 257
Deep learning for anomaly detection in log data: A survey
Landauer, M., Onder, S., Skopik, F., & Wurzenberger, M. (2023) · Machine Learning with Applications · doi:10.1016/j.mlwa.2023.100470 · Cited by 286
LAnoBERT: System log anomaly detection based on BERT masked language model
Lee, Y., Kim, J., & Kang, P. (2023) · Applied Soft Computing · doi:10.1016/j.asoc.2023.110689 · Cited by 159
Metadata
- Authors
- Nedelkoski, S., Bogatinovski, J., Acker, A., Cardoso, J., & Kao, O.
- Affiliations
- Technische Universität Berlin (DE)
- Huawei German Research Center (DE)
- Venue
- 2020 IEEE International Conference on Data Mining (ICDM)
- Publisher
- IEEE
- Published
- 2020-11
- Pages
- 1196-1201
- ISSN
- 1550-4786 (ISSN-L)
- OpenAlex
- W3127712067
- Cited by
- 176
- References
- 26
- Citations by year
- 2026: 22 · 2025: 34 · 2024: 38 · 2023: 47 · 2022: 19 · 2021: 16
- FWCI
- 17.20
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- Proceedings (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Software System Performance and Reliability
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- anomaly detection, system logs, self-attention, log classification, overfitting regularization, cybersecurity
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
