The DOI matches its DataCite record; 24 of the 24 references it cites were found in a registry or an index.
LogBERT: Log Anomaly Detection via BERT
Open accessAbstract
Detecting anomalous events in online computer systems is crucial to protect the systems from malicious attacks or malfunctions. System logs, which record detailed information of computational events, are widely used for system status analysis. In this paper, we propose LogBERT, a self-supervised framework for log anomaly detection based on Bidirectional Encoder Representations from Transformers (BERT). LogBERT learns the patterns of normal log sequences by two novel self-supervised training tasks and is able to detect anomalies where the underlying patterns deviate from normal log sequences. The experimental results on three log datasets show that LogBERT outperforms state-of-the-art approaches for anomaly detection.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Classical unsupervised techniques, including PCA and Isolation Forest, obtained F1-scores of 0.741 and 0.718, respectively, on the HDFS dataset.
“Classical unsupervised techniques, including PCA and Isolation Forest, obtained F1-scores of 0.741 and 0.718, respectively, on the HDFs dataset [6].”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
Table 2 in §4.2 (p. 8) reports HDFS F1-scores of 11.12% for PCA and 60.49% for iForest (Isolation Forest), not 0.741 and 0.718. The methods and dataset match, but the claimed scores contradict the paper's results. (LLM, conf=0.94)
Checked by a reasoning model — may be wrong.
Experimental — accuracy not yet measuredLogBERT has demonstrated state-of-the-art performance on structured and labeled datasets such as HDFS, BGL, and Thunderbird.
“While LogBERT has demonstrated state-of-the-art performance on structured and labeled datasets -such as Hadoop Distributed File System (HDFS), BlueGene/L (BGL), and Thunderbird -its applicability to heterogeneous and unlabeled Linux syslogs remains underexplored in the literature.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
The Experimental Results (p. 8) report that LogBERT achieved the highest F1 score among the tested baselines on HDFS, BGL, and Thunderbird, and the Experimental Setup (p. 7) describes anomaly labels for those datasets. However, the Framework (p. 3) describes the input log messages as unstructured and says they are parsed into log keys; the paper does not establish that the datasets themselves are structured. (LLM, conf=0.86)
Experimental — accuracy not yet measuredGuo et al. [6] followed a similar approach but with larger time windows between 1 to 5 min, and dropped windows shorter than 10 tokens.
“Guo et al. [6] followed a similar approach but with larger time windows between 1 to 5 min, and instead of following our buffering technique, they just dropped windows shorter than 10 tokens.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
The Experimental Setup (p. 7) says LogBERT used five-minute sliding windows for BGL and one-minute sliding windows for Thunderbird. Our copy does not say that windows shorter than 10 tokens were dropped; searches for that threshold and for discarded short sequences found no supporting passage. (LLM, conf=0.85)
Experimental — accuracy not yet measuredTraining and validation used 100% of available training windows, with a 10% split reserved for validation during training.
“Similarly to what [6] did, we conducted training and validation using 100% of the available training windows, with a 10% split reserved for validation during training.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
The Experimental Setup (p. 8) says LogBERT tuned hyperparameters using a small validation set. It does not say that training and validation used 100% of available training windows or that 10% was reserved for validation during training; searches for those split details found no supporting passage. (LLM, conf=0.78)
Experimental — accuracy not yet measuredThe baseline models were selected to align with existing literature and to support a balanced comparison between unsupervised and supervised approaches.
“The selection of these models aligns with the existing literature [6,14,15,22] and supports a balanced comparison between unsupervised and supervised approaches.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
The Baselines section (4.1, p. 7) compares LogBERT with several previously cited anomaly-detection methods, supporting the connection to existing literature. It identifies an unsupervised method, but does not describe the comparison as balanced between unsupervised and supervised approaches or identify a supervised baseline. (LLM, conf=0.85)
Experimental — accuracy not yet measured
Guo et al. demonstrated that moderate mask ratios preserved semantic context while still being challenging for the model to reconstruct missing information.
“Additionally, Guo et al. [6] demonstrated that moderate mask ratios preserved semantic context while still being challenging for the model to reconstruct the missing information.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
The parameter analysis (Section 4.2, p. 10) reports that mask ratios from 0.1 to 0.5 slightly improved F1 scores, while higher ratios removed too much information to make predictions. The objective-function description (Section 3.2, p. 5) confirms that the model predicts masked log keys from context. The paper does not establish that moderate ratios were specifically challenging for the model, so that part of the attributed explanation is unsupported. (LLM, conf=0.84)
Experimental — accuracy not yet measuredLogBERT is a transformer-based model leveraging self-supervised learning to detect anomalies in unstructured logs.
“The study builds upon the LogBERT architecture [6], a transformer-based model leveraging self-supervised learning to detect anomalies in unstructured logs.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
LogBERT employs a self-supervised masked language modeling objective combined with hypersphere minimization to detect deviations from expected patterns.
“Notably, LogBERT [6] employs a self-supervised masked language modeling objective combined with hypersphere minimization to detect deviations from expected patterns.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
The masking-and-reconstruction objective provides a principled anomaly score based on unexpected token predictions, suitable when explicit anomaly categories are unavailable.
“In addition, the masking-and-reconstruction objective provides a principled anomaly score based on unexpected token predictions, which is suitable when explicit anomaly categories are unavailable.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
LogBERT's performance on datasets like HDFS, BGL, and Thunderbird surpasses classical models such as PCA, DeepLog, and LogAnomaly.
“Its performance on datasets like HDFS, BGL, and Thunderbird surpasses classical models such as PCA, DeepLog, and LogAnomaly [6], making it well-suited for operational deployment under resource constraints.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
These labels were used solely to split the datasets so that LogBERT's unsupervised training could be restricted to only sequences that contained normal events.
“These labels were used solely to split the datasets in the next stages so that LogBERT's [6] unsupervised training could be restricted to only sequences that contained normal events.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
Anomaly labels were computed only for dataset splitting and evaluation, not for training.
“Although LogBERT [6] itself is trained in a completely unsupervised way, using only normal log sequences, labels are nevertheless computed at this stage for splitting purposes.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
They followed the same splitting approach as [6].
“We followed the same splitting approach as [6].”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
The evaluation reproduced the performance that Guo et al. reported on the HDFS, BGL, and Thunderbird datasets, where F1-scores reached 82.32%, 90.83%, and 96.64%, respectively.
“Our evaluation confirmed the validity of the experimental design because it reproduced the performance that Guo et al. [6] reported on the HDFS, BGL, and Thunderbird datasets, where F1-scores reached 82.32%, 90.83%, and 96.64%, respectively.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
Reproducibility was ensured by adopting an unsupervised training pipeline consistent with prior work [6].
“We ensured reproducibility by adopting an unsupervised training pipeline consistent with prior work [6].”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
Guo et al. deleted log sequences with fewer than 10 tokens, potentially omitting valuable anomalies.
“Initially, inspired by the approach of Guo et al. [6], who deleted log sequences with fewer than 10 tokens, potentially omitting valuable anomalies, we replicated their setup with a modification.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
The Framework (p. 3) describes forming log sequences from parsed log keys, and the Experimental Setup (p. 7) describes how sequences were grouped and their average lengths. Neither reports deleting sequences with fewer than 10 tokens. Searches for that threshold and for removal of short sequences found no supporting passage, so the suggested omission of anomalies cannot be verified from our copy. (LLM, conf=0.72)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, L., & Polosukhin, I. (2017) · arXiv · doi:10.48550/arxiv.1706.03762 · Cited by 120,404
BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding
Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2019) · Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers) · doi:10.18653/v1/n19-1423 · Cited by 54,325
Nonlinear Dimensionality Reduction by Locally Linear Embedding
Roweis, S. T., & Saul, L. K. (2000) · Science · doi:10.1126/science.290.5500.2323 · Cited by 14,965
Liu, F. T., Ting, K. M., & Zhou, Z.-H. (2008) · 2008 Eighth IEEE International Conference on Data Mining · doi:10.1109/icdm.2008.17 · Cited by 6,601
Estimating the Support of a High-Dimensional Distribution
Schölkopf, B., Platt, J. C., Shawe-Taylor, J., Smola, A. J., & Williamson, R. C. (2001) · Neural Computation · doi:10.1162/089976601750264965 · Cited by 6,168
DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning
Du, M., Li, F., Zheng, G., & Srikumar, V. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134015 · Cited by 1,835
Ruff, L., Vandermeulen, R. A., Görnitz, N., Deecke, L., Siddiqui, S. A., Binder, A., Müller, E., & Kloft, M. (2018) · International Conference on Machine Learning · Cited by 1,719
Detecting large-scale system problems by mining console logs
Xu, W., Huang, L., Fox, A., Patterson, D., & Jordan, M. I. (2009) · Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles · doi:10.1145/1629575.1629587 · Cited by 1,332
Drain: an online log parsing approach with fixed depth tree
He, P., Zhu, J., Zheng, Z., & Lyu, M. R. (2017) · 2017 IEEE International Conference on Web Services (ICWS) · doi:10.1109/icws.2017.13 · Cited by 943
Robust log-based anomaly detection on unstable log data
Zhang, X., Xu, Y., Lin, Q., Qiao, B., Zhang, H., Dang, Y., Xie, C., Yang, X., Cheng, Q., Li, Z., et al. (2019) · Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering · doi:10.1145/3338906.3338931 · Cited by 761
LogAnomaly: Unsupervised Detection of Sequential and Quantitative Anomalies in Unstructured Logs
Meng, W., Liu, Y., Zhu, Y., Zhang, S., Pei, D., Liu, Y., Chen, Y., Zhang, R., Tao, S., Sun, P., et al. (2019) · Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/658 · Cited by 708
What Supercomputers Say: A Study of Five System Logs
Oliner, A. J., & Stearley, J. (2007) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn.2007.103 · Cited by 695
Experience Report: System Log Analysis for Anomaly Detection
He, S., Zhu, J., He, P., & Lyu, M. R.-T. (2016) · Proceedings/Proceedings - International Symposium on Software Reliability Engineering · doi:10.1109/issre.2016.21 · Cited by 622
Log clustering based problem identification for online service systems
Lin, Q., Zhang, H., Lou, J., Zhang, Y., & Chen, X. (2016) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/2889160.2889232 · Cited by 493
Liu, F., Wen, Y., Zhang, D., Jiang, X., Xing, X., & Meng, D. (2019) · Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3319535.3363224 · Cited by 319
Loghub: a large collection of system log datasets for AI-driven log analytics
Zhu, J., He, S., He, P., Liu, J., & Lyu, M. R. (2023) · 2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE) · doi:10.1109/issre59848.2023.00071 · Cited by 302
Mining invariants from console logs for system problem detection
Lou, J., Fu, Q., Yang, S., Xu, Y., & Li, J. (2010) · Cited by 301
Yen, T.-F., Oprea, A., Onarlıoğlu, K., Leetham, T., Robertson, W., Juels, A., & Kirda, E. (2013) · Annual Computer Security Applications Conference · doi:10.1145/2523649.2523670 · Cited by 270
Improving one-class SVM for anomaly detection
Li, K., Huang, H., Tian, S., & Xu, W. M. (2004) · International Conference on Machine Learning and Cybernetics · doi:10.1109/icmlc.2003.1260106 · Cited by 261
Online System Problem Detection by Mining Patterns of Console Logs
Xu, W., Huang, L., Fox, A., Patterson, D. A., & Jordan, M. I. (2009) · Proceedings · doi:10.1109/icdm.2009.19 · Cited by 207
Automated IT system failure prediction: A deep learning approach
Zhang, K., Xu, J., Min, M. R., Jiang, G., Pelechrinis, K., & Zhang, H. (2016) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata.2016.7840733 · Cited by 193
Anomaly intrusion detection using one class SVM
Wang, Y., Wong, J., & Miner, A. S. (2005) · IEEE SMC Information Assurance Workshop (IAW) · doi:10.1109/iaw.2004.1437839 · Cited by 166
Event Logs for the Analysis of Software Failures: A Rule-Based Approach
Cinque, M., Cotroneo, D., & Pecchia, A. (2012) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2012.67 · Cited by 133
Multi-Scale One-Class Recurrent Neural Networks for Discrete Event Sequence Anomaly Detection
Wang, Z., Chen, Z., Ni, J., Liu, H., Chen, H., & Tang, J. (2021) · Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining · doi:10.1145/3447548.3467125 · Cited by 56
Flagged first, then by citations
Research works printed but not linked: 2
- [20]20. Yen, T.F., Oprea, A., Onarlioglu, K., Leetham, T., Robertson, W., Juels, A., Kirda, E.: Beehive: Large-scale log analysis for detecting suspicious activity in enterprise networks. In: Proceedings of the 29th Annual Computer Security Applications Conference. pp. 199-208 (2013)
- [24]24. He, S., Zhu, J., He, P., Lyu, M.R.: Loghub: A Large Collection of System Log Datasets towards Automated Log Analytics. arXiv:2008.06448 [cs] (Aug 2020) · arXiv
Cited by
Sorted by citations
Log-based Anomaly Detection Without Log Parsing
Le, V.-H., & Zhang, H. (2021) · 2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase51524.2021.9678773 · Cited by 361
Deep learning for anomaly detection in log data: A survey
Landauer, M., Onder, S., Skopik, F., & Wurzenberger, M. (2023) · Machine Learning with Applications · doi:10.1016/j.mlwa.2023.100470 · Cited by 286
Log-based anomaly detection with deep learning: how far are we?
Le, V.-H., & Zhang, H. (2022) · Proceedings of the 44th International Conference on Software Engineering · doi:10.1145/3510003.3510155 · Cited by 257
Kheddar, H. (2025) · Information Fusion · doi:10.1016/j.inffus.2025.103347 · Cited by 231
LAnoBERT: System log anomaly detection based on BERT masked language model
Lee, Y., Kim, J., & Kang, P. (2023) · Applied Soft Computing · doi:10.1016/j.asoc.2023.110689 · Cited by 155
Unifying the Perspectives of NLP and Software Engineering: A Survey on Language Models for CodePreprint
Zhang, Z., Chen, C., Liu, B., Liao, C., Gong, Z., Yu, H., Li, J., & Wang, R. (2023) · arXiv (Cornell University) · doi:10.13140/rg.2.2.32710.69440/1 · Cited by 132
Log Parsing with Prompt-based Few-shot Learning
Le, V.-H., & Zhang, H. (2023) · 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE) · doi:10.1109/icse48619.2023.00204 · Cited by 129
A Survey on XAI for 5G and Beyond Security: Technical Aspects, Challenges and Research Directions
Senevirathna, T., La, V. H., Marchal, S., Siniarski, B., Liyanage, M., & Wang, S. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3437248 · Cited by 122
LogFiT: Log Anomaly Detection Using Fine-Tuned Language Models
Almodovar, C., Sabrina, F., Karimi, S., & Azad, S. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3358730 · Cited by 111
BERT-Log: Anomaly Detection for System Logs Based on Pre-trained Language Model
Chen, S., & Liao, H. (2022) · Applied Artificial Intelligence · doi:10.1080/08839514.2022.2145642 · Cited by 107
AutoLog: Anomaly detection by deep autoencoding of system logs
Catillo, M., Pecchia, A., & Villano, U. (2022) · Expert Systems with Applications · doi:10.1016/j.eswa.2021.116263 · Cited by 102
RCAgent: Cloud Root Cause Analysis by Autonomous Agents with Tool-Augmented Large Language Models
Wang, Z., Liu, Z., Zhang, Y., Zhong, A., Wang, J., Yin, F., Fan, L., Wu, L., & Wen, Q. (2024) · Proceedings of the 33rd ACM International Conference on Information and Knowledge Management · doi:10.1145/3627673.3680016 · Cited by 99
LogGPT: Log Anomaly Detection via GPT
Han, X., Yuan, S., & Trabelsi, M. (2023) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata59044.2023.10386543 · Cited by 98
Self-citationMa, M., Han, L., & Zhou, C. (2023) · Advanced Engineering Informatics · doi:10.1016/j.aei.2023.101949 · Cited by 92
Unsupervised Cross-system Log Anomaly Detection via Domain Adaptation
Han, X., & Yuan, S. (2021) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3459637.3482209 · Cited by 75
Self-citationBenchmarking Large Language Models for Log Analysis, Security, and Interpretation
Karlsen, E., Luo, X., Zincir-Heywood, N., & Heywood, M. (2024) · Journal of Network and Systems Management · doi:10.1007/s10922-024-09831-x · Cited by 71
CAN-BERT do it? Controller Area Network Intrusion Detection System based on BERT Language Model
Alkhatib, N., Mushtaq, M., Ghauch, H., & Danger, J. (2022) · IEEE/ACS International Conference on Computer Systems and Applications (AICCSA) · doi:10.1109/aiccsa56895.2022.10017800 · Cited by 70
LogEncoder: Log-Based Contrastive Representation Learning for Anomaly Detection
Qi, J., Luan, Z., Huang, S., Fung, C., Yang, H., Li, H., Zhu, D., & Qian, D. (2023) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2023.3239522 · Cited by 69
Levshun, D., & Kotenko, I. V. (2023) · Artificial Intelligence Review · doi:10.1007/s10462-022-10381-4 · Cited by 67
Landauer, M., Skopik, F., & Wurzenberger, M. (2024) · Proceedings of the ACM on Software Engineering · doi:10.1145/3660768 · Cited by 61
Improving Log-Based Anomaly Detection by Pre-Training Hierarchical Transformers
Huang, S., Liu, Y., Fung, C., Wang, H., Yang, H., & Luan, Z. (2023) · IEEE Transactions on Computers · doi:10.1109/tc.2023.3257518 · Cited by 61
Temporal Logical Attention Network for Log-Based Anomaly Detection in Distributed Systems
Liu, Y., Ren, S., Wang, X., & Zhou, M. (2024) · Sensors · doi:10.3390/s24247949 · Cited by 53
LayerLog: Log sequence anomaly detection based on hierarchical semantics
Zhang, C., Wang, X., Zhang, H., Zhang, J., Zhang, H., Liu, C., & Han, P. (2022) · Applied Soft Computing · doi:10.1016/j.asoc.2022.109860 · Cited by 52
Zhang, C., Wang, X., Zhang, H., Zhang, H., & Han, P. (2021) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2021.3125967 · Cited by 49
MLog: Mogrifier LSTM-Based Log Anomaly Detection Approach Using Semantic Representation
Fu, Y., Liang, K., & Xu, J. (2023) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2023.3289488 · Cited by 49
OneLog: towards end-to-end software log anomaly detection
Hashemi, S., & Mäntylä, M. (2024) · Automated Software Engineering · doi:10.1007/s10515-024-00428-x · Cited by 24
Loader: A Log Anomaly Detector Based on Transformer
Xiao, T. Y., Quan, Z., Wang, Z.-J., Le, Y., Du, Y., Liao, X., Li, K., & Li, K. (2023) · IEEE Transactions on Services Computing · doi:10.1109/tsc.2023.3280575 · Cited by 44
EHR-BERT: A BERT-based model for effective anomaly detection in electronic health records
Niu, H., Omitaomu, O. A., Langston, M. A., Olama, M., Özmen, Ö., Klasky, H. B., Laurio, A., Ward, M. C., & Nebeker, J. R. (2024) · Journal of Biomedical Informatics · doi:10.1016/j.jbi.2024.104605 · Cited by 44
LogGT: Cross-system log anomaly detection via heterogeneous graph feature and transfer learning
Wang, P., Zhang, X., Cao, Z., Xu, W., & Li, W. (2024) · Expert Systems with Applications · doi:10.1016/j.eswa.2024.124082 · Cited by 44
KnowLog: Knowledge Enhanced Pre-trained Language Model for Log Understanding
Ma, L., Yang, W., Xu, B., Jiang, S., Fei, B., Liang, J., Zhou, M., & Xiao, Y. (2024) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3597503.3623304 · Cited by 43
Large language model-based optical network log analysis using LLaMA2 with instruction tuning
Pang, Y., Zhang, M., Liu, Y., Li, X., Wang, Y., Huan, Y., Liu, Z., Li, J., & Wang, D. (2024) · Journal of Optical Communications and Networking · doi:10.1364/jocn.527874 · Cited by 43
Anomaly Detection in Log Files Using Selected Natural Language Processing Methods
Ryciak, P., Wasielewska, K., & Janicki, A. (2022) · Applied Sciences · doi:10.3390/app12105089 · Cited by 43
LLM-LADE: Large language model-based log anomaly detection with explanation
Zhang, Z., Li, S., Zhang, L., Ye, J., Hu, C., & Yan, L. (2025) · Knowledge-Based Systems · doi:10.1016/j.knosys.2025.114064 · Cited by 42
A Review of Advancements and Applications of Pre-Trained Language Models in Cybersecurity
Liu, Z. (2024) · International Symposium on Digital Forensics and Security (ISDFS) · doi:10.1109/isdfs60797.2024.10527236 · Cited by 42
CAT: Beyond Efficient Transformer for Content-Aware Anomaly Detection in Event Sequences
Zhang, S., Liu, Y., Zhang, X., Cheng, W., Chen, H., & Xiong, H. (2022) · Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining · doi:10.1145/3534678.3539155 · Cited by 35
A comprehensive study of machine learning techniques for log-based anomaly detection
Ali, S., Boufaied, C., Bianculli, D., Branco, P., & Briand, L. (2025) · Empirical Software Engineering · doi:10.1007/s10664-025-10669-3 · Cited by 38
LogEval: A comprehensive benchmark suite for LLMs in log analysis
Cui, T., Ma, S., Chen, Z., Xiao, T., Zhao, C., Tao, S., Liu, Y., Zhang, S., Lin, D., Liu, C., et al. (2025) · Empirical Software Engineering · doi:10.1007/s10664-025-10701-6 · Cited by 36
Time Series Anomaly Detection Using Transformer-Based GAN With Two-Step Masking
Shin, A.-H., Kim, S. T., & Park, G.-M. (2023) · IEEE Access · doi:10.1109/access.2023.3289921 · Cited by 34
Detection of compromised functions in a serverless cloud environment
Ben-Shimol, L., Lavi, D., Klevansky, E., Brodt, O., Mimran, D., Elovici, Y., & Shabtai, A. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104261 · Cited by 33
MAD: Self-Supervised Masked Anomaly Detection Task for Multivariate Time Series
Fu, Y., & Feng, X. (2022) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn55064.2022.9892218 · Cited by 33
LLM Meets ML: Data-efficient Anomaly Detection on Unstable Logs
Hadadi, F., Xu, Q., Bianculli, D., & Briand, L. (2025) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3771283 · Cited by 32
A2Log: Attentive Augmented Log Anomaly Detection
Wittkopp, T., Acker, A., Nedelkoski, S., Bogatinovski, J., Scheinert, D., Wu, F., & Kao, O. (2022) · Hawaii International Conference on System Sciences (HICSS) · doi:10.24251/hicss.2022.234 · Cited by 30
Research on Log Anomaly Detection Based on Sentence-BERT
Hu, C., Xuekui, S., Dai, H., Zhang, H., & Liu, H. (2023) · Electronics · doi:10.3390/electronics12173580 · Cited by 29
Towards Evaluation and Understanding of Large Language Models for Cyber Operation Automation
Sultana, M., Taylor, A., Li, L., & Majumdar, S. (2023) · IEEE Conference on Communications and Network Security · doi:10.1109/cns59707.2023.10288677 · Cited by 29
Log Anomaly Detection with Conformal Alert Control and Evidence-Grounded Incident Ticket Generation
Xin, Q. (2026) · Aviation Electronics Information Technology Telecommunications Electricals Controls (AVITEC) · doi:10.28989/avitec.v8i2.3974 · Cited by 28
ClusterLog: Clustering Logs for Effective Log-based Anomaly Detection
Egersdoerfer, C., Zhang, D., & Dai, D. (2022) · IEEE/ACM Workshop on Fault Tolerance for HPC at eXtreme Scale (FTXS) · doi:10.1109/ftxs56515.2022.00006 · Cited by 27
USTEP: Unfixed Search Tree for Efficient Log Parsing
Vervaet, A., Chiky, R., & Callau-Zori, M. (2021) · Proceedings · doi:10.1109/icdm51629.2021.00077 · Cited by 26
Biglog: Unsupervised Large-scale Pre-training for a Unified Log Representation
Tao, S., Liu, Y., Meng, W., Ren, Z., Yang, H., Chen, X., Zhang, L., Xie, Y., Su, C., Oiao, X., et al. (2023) · International Workshop on Quality of Service · doi:10.1109/iwqos57198.2023.10188759 · Cited by 26
Research and application of Transformer based anomaly detection model: A literature reviewPreprint
Ma, M., Han, L., & Zhou, C. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2402.08975 · Cited by 26
LogEDL: Log Anomaly Detection via Evidential Deep Learning
Duan, Y., Xue, K., Sun, H., Bao, H., Wei, Y., You, Z., Zhang, Y., Jiang, X., Yang, S., Chen, J., et al. (2024) · Applied Sciences · doi:10.3390/app14167055 · Cited by 25
Anomaly Detection on Interleaved Log Data With Semantic Association Mining on Log-Entity Graph
Chu, G., Wang, J., Qi, Q., Sun, H., Zhuang, Z., He, B., Jing, Y., Zhang, L., & Liao, J. (2025) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2025.3527856 · Cited by 25
Tele-Knowledge Pre-training for Fault Analysis
Chen, Z., Wen, Z., Huang, Y., Chen, M., Geng, Y., Yu, H., Bi, Z., Zhang, Y., Yao, Z., Song, W., et al. (2023) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde55515.2023.00265 · Cited by 25
Self-citationSecurity in DevSecOps: Applying Tools and Machine Learning to Verification and Monitoring Steps
Cankar, M., Petrovic, N., Pita Costa, J., Cernivec, A., Antic, J., Martincic, T., & Stepec, D. (2023) · Companion of the 2023 ACM/SPEC International Conference on Performance Engineering · doi:10.1145/3578245.3584943 · Cited by 24
Systematic Evaluation of Deep Learning Models for Log-based Failure Prediction
Hadadi, F., Dawes, J. H., Shin, D., Bianculli, D., & Briand, L. (2024) · Empirical Software Engineering · doi:10.1007/s10664-024-10501-4 · Cited by 24
LEMAD: LLM-Empowered Multi-Agent System for Anomaly Detection in Power Grid Services
Ji, X., Zhang, L., Zhang, W., Peng, F., Mao, Y., Liao, X., & Zhang, K. (2025) · Electronics · doi:10.3390/electronics14153008 · Cited by 24
Wang, Q., Zhang, X., Wang, X., & Cao, Z. (2021) · Entropy · doi:10.3390/e24010069 · Cited by 24
Anomaly Detection in Cyber Security with Graph-Based LSTM in Log Analysis
Alaca, Y., Çelik, Y., & Goel, S. (2023) · Chaos Theory and Applications · doi:10.51537/chaos.1348302 · Cited by 24
Xin, Q. (2026) · JEECS (Journal of Electrical Engineering and Computer Sciences) · doi:10.54732/jeecs.v11i1.3 · Cited by 23
Adanomaly: Adaptive Anomaly Detection for System Logs with Adversarial Learning
Qi, J., Luan, Z., Huang, S., Wang, Y., Fung, C., Yang, H., & Qian, D. (2022) · IEEE/IFIP Network Operations and Management Symposium (NOMS) · doi:10.1109/noms54207.2022.9789917 · Cited by 23
Cinque, M., Corte, R. D., & Pecchia, A. (2022) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2022.103515 · Cited by 23
Automatic Parsing and Utilization of System Log Features in Log Analysis: A Survey
Ma, J., Liu, Y., Wan, H., & Sun, G. (2023) · Applied Sciences · doi:10.3390/app13084930 · Cited by 23
Li, L., & Chen, W. (2024) · Electronics · doi:10.3390/electronics13050945 · Cited by 23
Semi-supervised log anomaly detection based on bidirectional temporal convolution network
Yin, Z., Kong, X., & Yin, C. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103808 · Cited by 23
Pedroso, D. F., de Almeida, L., Pulcinelli, L. E. G., Pulcinelli, G., Akihiro, W., Aisawa, A., Dutra, I., & Bruschi, S. M. (2025) · IEEE Access · doi:10.1109/access.2025.3565220 · Cited by 22
Cyber threat detection: Unsupervised hunting of anomalous commands (UHAC)
Kayhan, V. O., Agrawal, M., & Shivendu, S. (2023) · Decision Support Systems · doi:10.1016/j.dss.2023.113928 · Cited by 22
LogLLaMA: Transformer-based log anomaly detection with LLaMA
Yang, Z., & Harris, I. G. (2025) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn64981.2025.11227209 · Cited by 21
MDFULog: Multi-Feature Deep Fusion of Unstable Log Anomaly Detection Model
Li, M., Sun, M., Li, G., Han, D., & Zhou, M. (2023) · Applied Sciences · doi:10.3390/app13042237 · Cited by 21
GLAD: Content-Aware Dynamic Graphs For Log Anomaly Detection
Li, Y., Liu, Y., Wang, H., Chen, Z., Cheng, W. D., Chen, Y., Yu, W., Chen, H., & Liu, C. (2023) · IEEE International Conference on Knowledge Graph (ICKG) · doi:10.1109/ickg59574.2023.00007 · Cited by 21
No, G., Lee, Y., Kang, H., & Kang, P. (2024) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2024.108613 · Cited by 21
Jin, H., Papadimitriou, G., Raghavan, K., Zuk, P., Balaprakash, P., Wang, C., Mandal, A., & Deelman, E. (2024) · International Conference for High Performance Computing, Networking, Storage and Analysis (SC) · doi:10.1109/sc41406.2024.00098 · Cited by 21
Log Sequence Anomaly Detection Based on Template and Parameter Parsing via BERT
Chai, X., Zhang, H., Zhang, J., Sun, Y., & Das, S. K. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2024.3428538 · Cited by 20
SSDLog: a semi-supervised dual branch model for log anomaly detection
Lu, S., Han, N., Wang, M., Wei, X., Lin, Z., & Wang, D. (2023) · World Wide Web · doi:10.1007/s11280-023-01174-y · Cited by 20
Retrieval-Grounded HDFS Log Anomaly Detection and Deterministic Failure Narrative Generation
Sun, X., Zhong, Z. S., & Wu, Q. (2026) · Journal of Computational Systems and Applications · doi:10.64229/j6d7fr94 · Cited by 19
Multi-source data based anomaly detection through temporal and spatial characteristics
Xu, P., Gao, Q., Zhang, Z., & Zhao, K. (2023) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.121675 · Cited by 18
Learning Representations on Logs for AIOps
Gupta, P., Kumar, H., Kar, D., Bhukar, K., Aggarwal, P., & Mohapatra, P. (2023) · IEEE ... International Conference on Cloud Computing · doi:10.1109/cloud60044.2023.00026 · Cited by 18
An Exploratory Study on How Non-Determinism in Large Language Models Affects Log Parsing
Astekin, M., Hort, M., & Moonen, L. (2024) · doi:10.1145/3643661.3643952 · Cited by 18
UniLog: Deploy One Model and Specialize it for All Log Analysis TasksPreprint
Zhu, Y., Meng, W., Liu, Y., Zhang, S., Han, T., Tao, S., & Pei, D. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2112.03159 · Cited by 18
Parameter-Efficient Log Anomaly Detection based on Pre-training model and LORA
He, S., Lei, Y., Zhang, Y., Xie, K., & Sharma, P. K. (2023) · Proceedings/Proceedings - International Symposium on Software Reliability Engineering · doi:10.1109/issre59848.2023.00038 · Cited by 17
Bai, J., Chen, S., Zheng, D., & Kuo, M.-J. (2026) · Informatics Electrical and Electronics Engineering (Infotron) · doi:10.33474/infotron.v6i1.24923 · Cited by 16
Graph neural networks based log anomaly detection and explanation
Li, Z., Shi, J., & van Leeuwen, M. (2026) · Data Mining and Knowledge Discovery · doi:10.1007/s10618-026-01235-6 · Cited by 16
LogPrompt: A Log-based Anomaly Detection Framework Using Prompts
Zhang, T., Huang, X., Zhao, W. P., Bian, S., & Du, P. (2023) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn54540.2023.10191948 · Cited by 16
Anomaly detection in log-event sequences: A federated deep learning approach and open challenges
Himler, P., Landauer, M., Skopik, F., & Wurzenberger, M. (2024) · Machine Learning with Applications · doi:10.1016/j.mlwa.2024.100554 · Cited by 16
AFMF: Time series anomaly detection framework with modified forecasting
Shen, L., Wei, Y., Wang, Y., & Li, H. (2024) · Knowledge-Based Systems · doi:10.1016/j.knosys.2024.111912 · Cited by 16
A classification-by-retrieval framework for few-shot anomaly detection to detect API injection
Aharon, U., Dubin, R., Dvir, A. Z., & Hajaj, C. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104249 · Cited by 16
Xie, X., Jian, S., Huang, C., Yu, F., & Deng, Y. (2023) · Proceedings/Proceedings - International Symposium on Software Reliability Engineering · doi:10.1109/issre59848.2023.00015 · Cited by 15
Log Anomaly Detection by Leveraging LLM-Based Parsing and Embedding with Attention Mechanism
Fariha, A., Gharavian, V., Makrehchi, M., Rahnamayan, S., Alwidian, S., & Azim, A. (2024) · Conference proceedings - Canadian Conference on Electrical and Computer Engineering · doi:10.1109/ccece59415.2024.10667308 · Cited by 15
Anomaly Transformer Ensemble Model for Cloud Data Anomaly Detection
Sakong, W., Kwon, J., Min, K., Wang, S., & Kim, W. (2024) · IEEE Transactions on Cloud Computing · doi:10.1109/tcc.2024.3466174 · Cited by 15
Anomaly Based Intrusion Detection Using Large Language Models
Maasaoui, Z., Merzouki, M., Battou, A., & Lbath, A. (2024) · IEEE/ACS International Conference on Computer Systems and Applications (AICCSA) · doi:10.1109/aiccsa63423.2024.10912623 · Cited by 15
LogRESP-Agent: A Recursive AI Framework for Context-Aware Log Anomaly Detection and TTP Analysis
Lee, J., Jeong, Y., Han, T., & Lee, T. (2025) · Applied Sciences · doi:10.3390/app15137237 · Cited by 15
Robust log anomaly detection based on contrastive learning and multi-scale MASS
Wang, X., Cao, Q., Wang, Q., Cao, Z., Zhang, X., & Wang, P. (2022) · The Journal of Supercomputing · doi:10.1007/s11227-022-04508-1 · Cited by 15
Log Anomaly Detection method based on BERT model optimization
Shao, Y., Zhang, W., Liu, P., Ren, H., Tang, R., Yin, Q., & Li, Q. L. (2022) · International Conference on Cloud Computing and Big Data Analytics (ICCCBDA) · doi:10.1109/icccbda55098.2022.9778900 · Cited by 15
SKDLog: Self-Knowledge Distillation-based CNN for Abnormal Log Detection
Han, N., Lu, S., Wang, D., Wang, M., Tan, X., & Wei, X. (2022) · IEEE Smart World Congress (SWC) · doi:10.1109/smartworld-uic-atc-scalcom-digitaltwin-pricomp-metaverse56740.2022.00122 · Cited by 15
Large language models and unsupervised feature learning: implications for log analysis
Karlsen, E., Luo, X., Zincir-Heywood, N., & Heywood, M. I. (2024) · Annals of Telecommunications · doi:10.1007/s12243-024-01028-2 · Cited by 14
Wang, P., Zhang, X., & Cao, Z. (2025) · Information Fusion · doi:10.1016/j.inffus.2025.103017 · Cited by 14
SemiRALD: A semi-supervised hybrid language model for robust Anomalous Log Detection
Sun, Y., Keung, J., Yang, Z., Liu, S., & Yu, H. K. (2025) · Information and Software Technology · doi:10.1016/j.infsof.2025.107743 · Cited by 14
Large Language Models for Security Operations Centers: A Comprehensive Survey
Habibzadeh, A., Feyzi, F., & Atani, R. E. (2026) · Journal of Electrical and Computer Engineering · doi:10.1155/jece/3383674 · Cited by 13
Few-Shot Log Anomaly Detection Based on Matching Networks
Han, C., Guan, B., Li, T., Kang, D., Qin, J., & Wu, Y. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3363626 · Cited by 13
LLMcap: Large Language Model for Unsupervised PCAP Failure Detection
Tulczyjew, Ł., Jarrah, K., Abondo, C., Bennett, D., & Weill, N. (2024) · IEEE International Conference on Communications workshops · doi:10.1109/iccworkshops59551.2024.10615433 · Cited by 13
A Comparative Study on Large Language Models for Log Parsing
Astekin, M., Hort, M., & Moonen, L. (2024) · Proceedings of the ... ACM-IEEE International Symposium on Empirical Software Engineering and Measurement/International Symposium on Empirical Software Engineering and Measurement · doi:10.1145/3674805.3686684 · Cited by 13
Zhou, J., Ying, S., Wang, S., Zhao, D., Xiang, J., Liang, K., & Liu, P. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3548050 · Cited by 13
Metadata
- Authors
- Guo, H., Yuan, S., & Wu, X.
- Affiliations
- Utah State University (US)
- University of Arkansas at Fayetteville (US)
- ORCID
- Wu, Xintao
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2021
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2103.04475
- OpenAlex
- W3134847483
- Cited by
- 7
- References
- 24
- Citations by year
- 2026: 1 · 2024: 2 · 2023: 2 · 2021: 2
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- arXiv (Cornell University) (submittedVersion, cc-by)
- Digital Commons - USU (Utah State University) (submittedVersion)
- arXiv (Cornell University) (cc-by)
- Digital Commons - USU (Utah State University)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Software System Performance and Reliability
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- log anomaly detection, system logs, BERT, self-supervised learning, intrusion detection, cybersecurity
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
