LogAnomaly: Unsupervised Detection of Sequential and Quantitative Anomalies in Unstructured Logs
Open accessAbstract
Recording runtime status via logs is common for almost every computer system, and detecting anomalies in logs is crucial for timely identifying malfunctions of systems. However, manually detecting anomalies for logs is time-consuming, error-prone, and infeasible. Existing automatic log anomaly detection approaches, using indexes rather than semantics of log templates, tend to cause false alarms. In this work, we propose LogAnomaly, a framework to model unstructured a log stream as a natural language sequence. Empowered by template2vec, a novel, simple yet effective method to extract the semantic information hidden in log templates, LogAnomaly can detect both sequential and quantitive log anomalies simultaneously, which were not done by any previous work. Moreover, LogAnomaly can avoid the false alarms caused by the newly appearing log templates between periodic model retrainings. Our evaluation on two public production log datasets show that LogAnomaly outperforms existing log-based anomaly detection methods.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Log parsing is evolving towards semantic alignment based on pre-trained language models.
“At present, it is evolving towards semantic alignment based on pre-trained language models [10],[11] .”
From A Survey of Anomaly Detection and Root Cause Analysis Techniques for Artificial Intelligence for IT Operations (AIOps) in Large-Scale Software Systems (2026) · cites this paper as [10]
Section 3.2 (page not provided) describes semantic representations of log templates, and Section 3.4 describes matching new templates by vector similarity. But Section 2 says log parsing is beyond the paper’s scope: it does not establish a trend toward semantic alignment in parsing or describe using pre-trained language models for that purpose. (LLM, conf=0.81)
Experimental — accuracy not yet measuredNeuralLog achieves the best performance because it utilizes WordPiece to tokenize an OOV word into subwords.
“NeuralLog achieves the best performance since it utilizes WordPiece [36], [37] to tokenize an OOV word into a set of subwords.”
From Log-based Anomaly Detection Without Log Parsing (2021) · cites this paper as [36]
Section 3.2 (Template2Vec; page unavailable) describes LogAnomaly’s synonym- and antonym-based word representation, not WordPiece tokenization of out-of-vocabulary words. Section 4.2 evaluates LogAnomaly, not NeuralLog. Searches for WordPiece, OOV subwords, and NeuralLog found no passage addressing the attributed explanation for NeuralLog’s performance. (LLM, conf=0.76)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Efficient Estimation of Word Representations in Vector Space
Mikolov, T., Chen, K., Corrado, G., & Dean, J. (2013) · arXiv · doi:10.48550/arxiv.1301.3781 · Cited by 26,568 · see citing works
WordNet: a lexical database for English
Miller, G. A. (1995) · Communications of the ACM · doi:10.1145/219717.219748 · Cited by 14,015 · cited 2× · see citing works
“Therefore, we first search synonyms and antonyms of the words in templates in WordNet.”
Background5.7 The WORDNET lexical database of English
Ooi, V. B. Y. (2019) · Edinburgh University Press eBooks · doi:10.1515/9781474471459-050 · Cited by 1,861 · see citing works
What Supercomputers Say: A Study of Five System Logs
Oliner, A., & Stearley, J. (2007) · Dependable Systems and Networks · doi:10.1109/dsn.2007.103 · Cited by 721 · see citing works
Experience Report: System Log Analysis for Anomaly Detection
He, S., Zhu, J., He, P., & Lyu, M. R.-T. (2016) · Proceedings/Proceedings - International Symposium on Software Reliability Engineering · doi:10.1109/issre.2016.21 · Cited by 622 · see citing works
Log clustering based problem identification for online service systems
Lin, Q., Zhang, H., Lou, J., Zhang, Y., & Chen, X. (2016) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/2889160.2889232 · Cited by 493 · see citing works
Mining invariants from console logs for system problem detection
Lou, J., Fu, Q., Yang, S., Xu, Y., & Li, J. (2010) · Cited by 301 · see citing works
Failure Prediction in IBM BlueGene/L Event Logs
Liang, Y., Zhang, Y., Xiong, H., & Sahoo, R. (2007) · Seventh IEEE International Conference on Data Mining (ICDM 2007) · doi:10.1109/icdm.2007.46 · Cited by 292 · see citing works
Identifying impactful service system problems via log analysis
He, S., Lin, Q., Lou, J., Zhang, H., Lyu, M. R.-T., & Zhang, D. (2018) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3236024.3236083 · Cited by 205 · see citing works
Automated IT system failure prediction: A deep learning approach
Zhang, K., Xu, J., Min, M. R., Jiang, G., Pelechrinis, K., & Zhang, H. (2016) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata.2016.7840733 · Cited by 187 · see citing works
A search-based approach for accurate identification of log message formats
Messaoudi, S., Panichella, A., Bianculli, D., Briand, L., & Sasnauskas, R. (2018) · IEEE International Conference on Program Comprehension (ICPC) · doi:10.1145/3196321.3196340 · Cited by 168 · see citing works
Anomaly Detection Using Program Control Flow Graph Mining From Execution Logs
Nandi, A., Mandal, A., Atreja, S., Dasgupta, G. B., & Bhattacharya, S. (2016) · Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining · doi:10.1145/2939672.2939712 · Cited by 154 · see citing works
Integrating Distributional Lexical Contrast into Word Embeddings for Antonym-Synonym Distinction
Nguyen, K. A., Walde, S. S. I., & Vu, N. T. (2016) · Proceedings of the conference - Association for Computational Linguistics. Meeting · doi:10.18653/v1/p16-2074 · Cited by 107 · see citing works
Syslog processing for switch failure diagnosis and prediction in datacenter networks
Zhang, S., Meng, W., Bu, J., Yang, S., Liu, Y., Pei, D., Xu, J. J., Chen, Y., Dong, H. F., Qu, X., et al. (2017) · International Workshop on Quality of Service · doi:10.1109/iwqos.2017.7969130 · Cited by 96 · see citing works
Self-citationRobust and Rapid Adaption for Concept Drift in Software System Anomaly Detection
Ma, M., Zhang, S., Pei, D., Huang, X., & Dai, H. (2018) · Proceedings/Proceedings - International Symposium on Software Reliability Engineering · doi:10.1109/issre.2018.00013 · Cited by 96 · see citing works
Self-citationRapid and robust impact assessment of software changes in large internet-based services
Zhang, S., Liu, Y., Pei, D., Chen, Y., Qu, X., Tao, S., & Zang, Z. (2015) · ACM International Conference on emerging Networking EXperiments and Technologies (CoNEXT) · doi:10.1145/2716281.2836087 · Cited by 56 · see citing works
Self-citationDevice-Agnostic Log Anomaly Classification with Partial Labels
Meng, W., Liu, Y., Zhang, S., Pei, D., Dong, H. F., Song, L., & Luo, X. (2018) · International Workshop on Quality of Service · doi:10.1109/iwqos.2018.8624141 · Cited by 54 · see citing works
Self-citationFUNNEL: Assessing Software Changes in Web-Based Services
Zhang, S., Liu, Y., Pei, D., et al. (2016) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2016.2539945 · Cited by 49 · see citing works
Self-citationADELE: Anomaly Detection from Event Log Empiricism
Khatuya, S., Ganguly, N., Basak, J., Bharde, M., & Mitra, B. (2018) · IEEE Conference on Computer Communications (INFOCOM) · doi:10.1109/infocom.2018.8486257 · Cited by 48 · see citing works
Rapid Deployment of Anomaly Detection Models for Large Number of Emerging KPI Streams
Bu, J., Liu, Y., Zhang, S., Meng, W., Liu, Q., Zhu, X., & Pei, D. (2018) · IEEE International Performance, Computing, and Communications Conference · doi:10.1109/pccc.2018.8711315 · Cited by 34 · see citing works
Self-citationLearning Latent Events from Network Message Logs: A Decomposition Based Approach.Preprint
Satpathi, S., Deb, S., Srikant, R., et al. (2018) · arXiv (Cornell University) · Cited by 2 · see citing works
Flagged first, then by citations
Research works printed but not linked: 3
- Du et al., 2017] Min Du, Feifei Li, Guineng Zheng, and Vivek Srikumar. Deeplog: Anomaly detection and diag- nosis from system logs through deep learning. In Proceed- ings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pages 1285-1298. ACM, 2017.
- Wei Xu, Ling Huang, Armando Fox, David Patterson, and Michael Jordan. Largescale system prob- lem detection by mining console logs. Proceedings of SOSP'09, 2009.
- Zhang et al., 2018a] Shenglin Zhang, Ying Liu, Weibin Meng, Zhiling Luo, Jiahao Bu, Sen Yang, Peixian Liang, Dan Pei, Jun Xu, Yuzhi Zhang, et al. Prefix: Switch fail- ure prediction in datacenter networks. Proceedings of the ACM on Measurement and Analysis of Computing Sys- tems, 2(1):2, 2018.
Cited by
Sorted by citations
LogBERT: Log Anomaly Detection via BERT
Guo, H., Yuan, S., & Wu, X. (2021) · 2021 International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn52387.2021.9534113 · Cited by 454 · see citing works
A Survey on Automated Log Analysis for Reliability Engineering
He, S., He, P., Chen, Z., Yang, T., Su, Y., & Lyu, M. R. (2022) · ACM Computing Surveys · doi:10.1145/3460345 · Cited by 334 · see citing works
Log-based Anomaly Detection Without Log Parsing
Le, V.-H., & Zhang, H. (2021) · 2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase51524.2021.9678773 · Cited by 289 · see citing works
“However, LogAnomaly [12] has no publicly available implementation and requires operators’ domain knowledge (to manually add domain-specific synonyms and antonyms).”
BackgroundMethodInfluentialLog-based anomaly detection with deep learning: how far are we?
Le, V.-H., & Zhang, H. (2022) · Proceedings of the 44th International Conference on Software Engineering · doi:10.1145/3510003.3510155 · Cited by 257 · see citing works
Self-Attentive Classification-Based Anomaly Detection in Unstructured Logs
Nedelkoski, S., Bogatinovski, J., Acker, A., Cardoso, J., & Kao, O. (2020) · 2020 IEEE International Conference on Data Mining (ICDM) · doi:10.1109/icdm50108.2020.00148 · Cited by 176 · see citing works
Eadro: An End-to-End Troubleshooting Framework for Microservices on Multi-source Data
Lee, C., Yang, T., Chen, Z., Su, Y., & Lyu, M. R. (2023) · 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE) · doi:10.1109/icse48619.2023.00150 · Cited by 149 · see citing works
Robust Failure Diagnosis of Microservice System Through Multimodal Data
Zhang, S., Jin, P., Lin, Z., Sun, Y., Zhang, B., Xia, S., Li, Z., Zhong, Z., Ma, M., Jin, W., et al. (2023) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2023.3290018 · Cited by 118 · see citing works
Self-citationLogFiT: Log Anomaly Detection Using Fine-Tuned Language Models
Almodovar, C., Sabrina, F., Karimi, S., & Azad, S. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3358730 · Cited by 111 · see citing works
Zuo, Y., Wu, Y., Min, G., Huang, C., & Pei, K. (2020) · IEEE Transactions on Cognitive Communications and Networking · doi:10.1109/tccn.2020.2966615 · Cited by 94 · see citing works
Huang, T., Chen, P., & Li, R. (2022) · Proceedings of the ACM Web Conference 2022 · doi:10.1145/3485447.3511984 · Cited by 61 · see citing works
Self-Supervised Anomaly Detection from Distributed Traces
Bogatinovski, J., Nedelkoski, S., Cardoso, J., & Kao, O. (2020) · 2020 IEEE/ACM 13th International Conference on Utility and Cloud Computing (UCC) · doi:10.1109/ucc48980.2020.00054 · Cited by 50 · see citing works
Twin Graph-Based Anomaly Detection via Attentive Multi-Modal Learning for Microservice System
Huang, J., Yang, Y., Yu, H., Li, J., & Zheng, X. (2023) · 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase56229.2023.00138 · Cited by 50 · see citing works
LLM-LADE: Large language model-based log anomaly detection with explanation
Zhang, Z., Li, S., Zhang, L., Ye, J., Hu, C., & Yan, L. (2025) · Knowledge-Based Systems · doi:10.1016/j.knosys.2025.114064 · Cited by 42 · see citing works
PUTraceAD: Trace Anomaly Detection with Partial Labels based on GNN and PU Learning
Zhang, K., Zhang, C., Peng, X., & Sha, C. (2022) · 2022 IEEE 33rd International Symposium on Software Reliability Engineering (ISSRE) · doi:10.1109/issre55969.2022.00032 · Cited by 33 · see citing works
DeepTaskAPT: Insider APT detection using Task-tree based Deep Learning
Mamun, M., & Shi, K. (2021) · 2021 IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom53373.2021.00102 · Cited by 29 · see citing works
Learning State Machines to Monitor and Detect Anomalies on a Kubernetes Cluster
Cao, C., Blaise, A., Verwer, S., & Rebecchi, F. (2022) · Proceedings of the 17th International Conference on Availability, Reliability and Security · doi:10.1145/3538969.3543810 · Cited by 27 · see citing works
AcLog: An Approach to Detecting Anomalies from System Logs with Active Learning
Duan, C., Jia, T., Li, Y., & Huang, G. (2023) · 2023 IEEE International Conference on Web Services (ICWS) · doi:10.1109/icws60048.2023.00062 · Cited by 20 · see citing works
AFALog: A General Augmentation Framework for Log-based Anomaly Detection with Active Learning
Duan, C., Jia, T., Cai, H., Li, Y., & Huang, G. (2023) · 2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE) · doi:10.1109/issre59848.2023.00068 · Cited by 17 · see citing works
Practitioners’ expectations on log anomaly detection
Ma, X., Li, Y., Keung, J., Yu, X., Zou, H., Yang, Z., Sarro, F., & Barr, E. T. (2025) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2025.3586700 · Cited by 14 · see citing works
“L OGS are a crucial source of information in software systems, capturing system runtime behavior and aiding in software engineering tasks like program comprehension [1], [2], anomaly detection [3], [4], [5], [6], and failure diagnosis [7], [8].”
The Insider Threat Detection Method of University Website Clusters Based on Machine Learning
Li, Y., & Su, Y. (2023) · 2023 6th International Conference on Artificial Intelligence and Big Data (ICAIBD) · doi:10.1109/icaibd57115.2023.10206282 · Cited by 14 · see citing works
Fault Localization for Microservice Applications with System Logs and Monitoring Metrics
Zhang, Q., Jia, T., Wu, Z., Wu, Q., Jia, L., Li, D., Tao, Y., & Xiao, Y. (2022) · 2022 7th International Conference on Cloud Computing and Big Data Analytics (ICCCBDA) · doi:10.1109/icccbda55098.2022.9778893 · Cited by 13 · see citing works
DyCause: Crowdsourcing to Diagnose Microservice Kernel Failure
Pan, Y., Ma, M., Jiang, X., & Wang, P. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3233915 · Cited by 11 · see citing works
LogExpert: Log-based Recommended Resolutions Generation using Large Language Model
Wang, J., Chu, G., Wang, J., Sun, H., Qi, Q., Wang, Y., Qi, J., & Liao, J. (2024) · Proceedings of the 2024 ACM/IEEE 44th International Conference on Software Engineering: New Ideas and Emerging Results · doi:10.1145/3639476.3639773 · Cited by 12 · see citing works
Yu, E. (2026) · 2026 6th International Conference on Artificial Intelligence and Industrial Technology Applications (AIITA) · doi:10.1109/aiita69518.2026.11567316
Explainable Anomaly Detection for System Logs in Distributed Environments
Gu, Z., Yue, W., & Liu, C. (2026) · Computers, Materials & Continua · doi:10.32604/cmc.2026.077388
“…feature extraction: DeepLog [3] uses LSTMs for log sequence prediction but adopts a centralized architecture and lacks explainability; LogAnomaly [4] integrates structural and parameter features via dual-channel LSTMs but fails to mitigate privacy risks and suffers from opaque attention weights;…”
LogRCA: Log-based Root Cause Analysis for Distributed Services
Wittkopp, T., Wiesner, P., & Kao, O. (2024) · arXiv · doi:10.48550/arxiv.2405.13599
“LogAnomaly [19] introduces the template2vec representation method and fuses it with LSTM networks into an end-to-end framework that detects sequential and quantitative anomalies.”
Method
- Authors
- Meng, W., Liu, Y., Zhu, Y., Zhang, S., Pei, D., Liu, Y., Chen, Y., Zhang, R., Tao, S., Sun, P., & Zhou, R.
- Affiliations
- Beijing National Research Center for Information Science and Technology (CN)
- Nankai University (CN)
- University of Toronto (CA)
- Huawei Technologies (China) (CN)
- ORCID
- Venue
- Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence
- Published
- 2019-08
- Pages
- 4739-4745
- OpenAlex
- W2965838158
- Cited by
- 708
- References
- 21
- Citations by year
- 2026: 120 · 2025: 144 · 2024: 129 · 2023: 134 · 2022: 76 · 2021: 78 · 2020: 25 · 2019: 2
- FWCI
- 39.11
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- International Joint Conference on Artificial Intelligence (publishedVersion)
- Funders
- National Natural Science Foundation of China (61402257, 61772307)
- Fundamental Research Funds for the Central Universities
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Software System Performance and Reliability
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- log anomaly detection, unsupervised anomaly detection, log templates, sequential anomaly detection, false alarm reduction, model retraining, production logs
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
