The DOI matches its DataCite record; 24 of the 24 references it cites were found in a registry or an index.
LogBERT: Log Anomaly Detection via BERT
Open accessAbstract
Detecting anomalous events in online computer systems is crucial to protect the systems from malicious attacks or malfunctions. System logs, which record detailed information of computational events, are widely used for system status analysis. In this paper, we propose LogBERT, a self-supervised framework for log anomaly detection based on Bidirectional Encoder Representations from Transformers (BERT). LogBERT learns the patterns of normal log sequences by two novel self-supervised training tasks and is able to detect anomalies where the underlying patterns deviate from normal log sequences. The experimental results on three log datasets show that LogBERT outperforms state-of-the-art approaches for anomaly detection.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source doesn’t support the claim as written.
In the citing paper
“Classical unsupervised techniques, including PCA and Isolation Forest, obtained F1-scores of 0.741 and 0.718, respectively, on the HDFs dataset [6].”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
Checked by a reasoning model — may be wrong.
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“While LogBERT has demonstrated state-of-the-art performance on structured and labeled datasets -such as Hadoop Distributed File System (HDFS), BlueGene/L (BGL), and Thunderbird -its applicability to heterogeneous and unlabeled Linux syslogs remains underexplored in the literature.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Guo et al. [6] followed a similar approach but with larger time windows between 1 to 5 min, and instead of following our buffering technique, they just dropped windows shorter than 10 tokens.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Similarly to what [6] did, we conducted training and validation using 100% of the available training windows, with a 10% split reserved for validation during training.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“The selection of these models aligns with the existing literature [6,14,15,22] and supports a balanced comparison between unsupervised and supervised approaches.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
Experimental — accuracy not yet measured
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Additionally, Guo et al. [6] demonstrated that moderate mask ratios preserved semantic context while still being challenging for the model to reconstruct the missing information.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
Experimental — accuracy not yet measuredThe cited source says what the claim attributes to it.
In the citing paper
“The study builds upon the LogBERT architecture [6], a transformer-based model leveraging self-supervised learning to detect anomalies in unstructured logs.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
The cited source says what the claim attributes to it.
In the citing paper
“Notably, LogBERT [6] employs a self-supervised masked language modeling objective combined with hypersphere minimization to detect deviations from expected patterns.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
The cited source says what the claim attributes to it.
In the citing paper
“In addition, the masking-and-reconstruction objective provides a principled anomaly score based on unexpected token predictions, which is suitable when explicit anomaly categories are unavailable.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
The cited source says what the claim attributes to it.
In the citing paper
“Its performance on datasets like HDFS, BGL, and Thunderbird surpasses classical models such as PCA, DeepLog, and LogAnomaly [6], making it well-suited for operational deployment under resource constraints.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
The cited source says what the claim attributes to it.
In the citing paper
“These labels were used solely to split the datasets in the next stages so that LogBERT's [6] unsupervised training could be restricted to only sequences that contained normal events.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
The cited source says what the claim attributes to it.
In the citing paper
“Although LogBERT [6] itself is trained in a completely unsupervised way, using only normal log sequences, labels are nevertheless computed at this stage for splitting purposes.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
The cited source says what the claim attributes to it.
In the citing paper
“We followed the same splitting approach as [6].”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
The cited source says what the claim attributes to it.
In the citing paper
“Our evaluation confirmed the validity of the experimental design because it reproduced the performance that Guo et al. [6] reported on the HDFS, BGL, and Thunderbird datasets, where F1-scores reached 82.32%, 90.83%, and 96.64%, respectively.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
The cited source says what the claim attributes to it.
In the citing paper
“We ensured reproducibility by adopting an unsupervised training pipeline consistent with prior work [6].”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“Initially, inspired by the approach of Guo et al. [6], who deleted log sequences with fewer than 10 tokens, potentially omitting valuable anomalies, we replicated their setup with a modification.”
From Log anomaly detection in AIOps: A real-world implementation using Large Language Models (2026) · cites this paper as [6]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, L., & Polosukhin, I. (2017) · arXiv · doi:10.48550/arxiv.1706.03762 · Cited by 120,404
BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding
Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2019) · Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers) · doi:10.18653/v1/n19-1423 · Cited by 54,325
Nonlinear Dimensionality Reduction by Locally Linear Embedding
Roweis, S. T., & Saul, L. K. (2000) · Science · doi:10.1126/science.290.5500.2323 · Cited by 14,965
Liu, F. T., Ting, K. M., & Zhou, Z.-H. (2008) · 2008 Eighth IEEE International Conference on Data Mining · doi:10.1109/icdm.2008.17 · Cited by 6,601
Estimating the Support of a High-Dimensional Distribution
Schölkopf, B., Platt, J. C., Shawe-Taylor, J., Smola, A. J., & Williamson, R. C. (2001) · Neural Computation · doi:10.1162/089976601750264965 · Cited by 6,168
DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning
Du, M., Li, F., Zheng, G., & Srikumar, V. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134015 · Cited by 1,835
Ruff, L., Vandermeulen, R. A., Görnitz, N., Deecke, L., Siddiqui, S. A., Binder, A., Müller, E., & Kloft, M. (2018) · International Conference on Machine Learning · Cited by 1,719
Detecting large-scale system problems by mining console logs
Xu, W., Huang, L., Fox, A., Patterson, D., & Jordan, M. I. (2009) · Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles · doi:10.1145/1629575.1629587 · Cited by 1,332
Drain: an online log parsing approach with fixed depth tree
He, P., Zhu, J., Zheng, Z., & Lyu, M. R. (2017) · 2017 IEEE International Conference on Web Services (ICWS) · doi:10.1109/icws.2017.13 · Cited by 943
Robust log-based anomaly detection on unstable log data
Zhang, X., Xu, Y., Lin, Q., Qiao, B., Zhang, H., Dang, Y., Xie, C., Yang, X., Cheng, Q., Li, Z., et al. (2019) · Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering · doi:10.1145/3338906.3338931 · Cited by 761
Flagged first, then by citations
Research works printed but not linked: 2
- [20]20. Yen, T.F., Oprea, A., Onarlioglu, K., Leetham, T., Robertson, W., Juels, A., Kirda, E.: Beehive: Large-scale log analysis for detecting suspicious activity in enterprise networks. In: Proceedings of the 29th Annual Computer Security Applications Conference. pp. 199-208 (2013)
- [24]24. He, S., Zhu, J., He, P., Lyu, M.R.: Loghub: A Large Collection of System Log Datasets towards Automated Log Analytics. arXiv:2008.06448 [cs] (Aug 2020) · arXiv
Cited by
Sorted by citations
Items 501–561 of 561
AI-Augmented Catastrophe Modeling with an Intelligent Orchestration Workflow
Patel, J. A., Wang, T., Hamid, S. S., Shyu, M., & Chen, S.-C. (2026) · IEEE International Conference on Information Reuse and Integration (IRI) · doi:10.1109/iri69576.2026.00062
Cirkovic, M. (2026) · Doria (University of Helsinki)
Ступак, А. І. (2026) · Електронний архів наукових та освітніх матеріалів КПІ ім. Ігоря Сікорського (КПІ ім. Ігоря Сікорського)
Automated Transformer-Based Software Log Anomaly Detection and Diagnosis
Shi, Q., Yang, Z., Grant, E., & Shao, S. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-38404-1_46
Conditional Multimodal Fusion for Time-Series Anomaly Detection
Wang, B., Du, M., Zhang, M., Xu, K., Xu, Z., Xu, S., & Yang, Y. (2026) · International Conference on Big Data and Information Analytics (BigDIA) · doi:10.1109/bigdia71496.2026.11684663
A Dataset-Aware Drift-Robust Log Anomaly Detection Pipeline for Cloud Service Reliability
Weerabangsa, N. (2026) · Moratuwa Engineering Research Conference (MERCon) · doi:10.1109/mercon71835.2026.11691438
Duc, M. N., Manh, T. D., Quang, D. N., Hai, Q. V., & Hoang, H. N. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-5644-0_17
Xin, Q. (2026) · JEECS (Journal of Electrical Engineering and Computer Sciences) · doi:10.54732/jeecs.v11i2.3
Omoighe, J. A., Atoyebi, T. O., Kolapo, R., & Kirubakaran, P. A. (2026) · Iconic Research and Engineering Journals · doi:10.64388/irev10i3-1723220
Efficient Log Anomaly Detection via Dual-Domain State Space Modeling
Hu, X., Feng, G., Wang, R., Yang, D., & Chen, C. (2026) · Computers · doi:10.3390/computers15090628
Kirtac, K., & Maple, C. (2026) · arXiv (Cornell University) · doi:10.48550/arxiv.2609.23659
Ponduru, P. S., Nandanavanam, P. P. V., & Ponduru, S. K. K. (2025) · World Journal of Advanced Research and Reviews · doi:10.30574/wjarr.2025.27.3.3148
Shareef, M. A. (2026) · Iconic Research and Engineering Journals · doi:10.64388/irev10i3-1723189
Hybrid Content- and Session-Based Anomaly Detection for Web Server Logs
Rehman, A., Nouman, M., & Saleh, M. H. (2026) · Future Internet · doi:10.3390/fi18100511
Shinoz, T., & Niranjana, G. (2026) · Technology and Innovation Conference (TIC) · doi:10.1109/tic68483.2026.11703004
Arunvinodh, C., & Rao, N. V. (2026) · International Conference on Innovations in Mechanical, Robotics, Computing and Biomedical Engineering (ICIMRBE) · doi:10.1109/icimrbe70745.2026.11709915
Jang, S., Park, J., Kim, N., Park, S., & Kim, Y. (2026) · IEEE Access · doi:10.1109/access.2026.3738895
N., W. M. M. (2026) · International Conference on Advanced Network Technologies and Applications (APAN) · doi:10.1109/apan70967.2026.11709764
Machine Learning-Driven Anomaly Detection: Strengthening Siem Tools For Robust Cyber Defense
Arora, R. (2024) · Journal of Propulsion Technology
Oblakevych, K. (2026) · Frontiers in Emerging Computer Science and Information Technology
Anomaly Detection in Azure Cloud Infrastructure Using Machine Learning
Lakavath, S. R. (2026) · Stout in Computer Science and Technology Studies · doi:10.61424/f9w38090
Explainable Transformer Models for Insider Threat Detection in Enterprise Systems
Al-Dhaqm, A., Bamasoud, D. M., Brnawy, R., Bamaqa, A., Alharbi, A. A., & Aljubayri, I. (2026) · Engineering Technology & Applied Science Research · doi:10.48084/etasr.21281
Kim, E., & Shon, T. (2026) · Journal of Digital Contents Society · doi:10.9728/dcs.2026.27.9.2609
Causal Graph Constrained LLM for Fault Diagnosis in Industrial Data CentersPreprint
Wei, S., Qiuyuan, Z., Wei, L., Yang, W., & Luo, Y. (2026) · doi:10.22541/authorea.15009845/v1
Russkikh, A. R., Levshun, D. S., & Александрович, У. И. (2026) · International Russian Automation Conference (RusAutoCon) · doi:10.1109/rusautocon69876.2026.11707425
Protocol-Aware Multi-Step Summarization of 5G Logs
Kuniyil, N., Jung, W., Mamaghani, A., Shakkottai, S., & Bharadia, D. (2026) · ACM Workshop on Wireless of the Students, by the Students, for the Students (S3) · doi:10.1145/3842433.3843763
Xiao, H., Janet, S., Li, Z., Qian, G., & 许楚宏 (2026) · arXiv (Cornell University) · doi:10.48550/arxiv.2610.05807
Srivastava, R. R., & Tripathi, M. M. (2026) · Advances in intelligent systems research/Advances in Intelligent Systems Research · doi:10.2991/978-94-6239-789-7_36
When Log Parsing Removes What Matters: Detecting Failures in Distributed GPU Workloads
Cui, B., Zeng, Y., Tian, Y., & Jacobsen, H. (2026) · doi:10.1145/3820756.3844919
Benítez, I. D. D. (2026) · Archivo Digital UPM (Universidad Politécnica de Madrid)
Fu, S., Han, Y., & Bekmuratov, D. (2026) · Techscience.uz. · doi:10.47390/ts-v4i10y2026n03
Choi, W., Sagong, H., & Yoon, Y. (2026) · Research Square · doi:10.21203/rs.3.rs-10925452/v1
AI-Assisted Web Server Log Interpretation Using LLaMA Model
Mrs. Chinchu Mohanan, K., & Ganesh, V. R. (2026) · International Journal for Research in Applied Science and Engineering Technology · doi:10.22214/ijraset.2026.85161
Attribution-Aware Log Anomaly Detection via Index-Preserving Multi-View Fusion
Tian, Y., & Ying, S. (2026) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn69854.2026.11728526
LogRD: A Robustness-Enhanced Framework for Log Anomaly Detection with Dynamic Masking
Liang, X., Zou, X., Ren, J., Su, Z., Zheng, C., & Xu, W. (2026) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn69854.2026.11728675
Bridging Privacy and Performance: A Hybrid LLM Agent for Security Operations
Radah, T., Chaoui, H., & Saadi, C. (2026) · Lecture notes in networks and systems · doi:10.1007/978-3-032-34621-6_8
K-LAD: Knowledge-Enhanced Log Anomaly Detection via Syntax-Aware Verification
Mi, L., Zhang, H., Li, L., Gu, W., Tian, F., & Ling, C. (2026) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn69854.2026.11728454
Semantic and Temporal Feature Augmentation for Log-Based System Failure Prediction
Tian, Y., Ying, S., & Li, J. (2026) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn69854.2026.11729926
Context-Aware SIEM Rule Generation with LLMs: When Site Profiles Are Not Enough
Schafhauzer, P., Kapelinski, C., Pohlmann, M., & Kreutz, D. (2026) · Simpósio Brasileiro de Cibersegurança (SBSeg) · doi:10.5753/sbseg.2026.29389
Talasso, G. U., de Souza, A. M., & Villas, L. A. (2026) · doi:10.5753/wiarc.2026.22936
Melny, O. (2026) · Cybersecurity Education Science Technique · doi:10.28925/2663-4023.2026.34.1307
A Mathematical Modeling Framework for Semantic–Temporal Graph Learning in Log Anomaly Detection
Gao, S., & Wang, X. (2026) · Mathematics · doi:10.3390/math14213866
Development of an Intelligent Security Information and Event Management System
Cynthia, N. U., Nwakeze, O. M., Mgbeafulike, I. J., & Agubosim, C. C. (2026) · International journal of research and scientific innovation · doi:10.51244/ijrsi.2026.1313cs030
МИННЕГУЛОВ, А. А. (n.d.) · CyberLeninK (CyberLeninka)
AI applications for automated anomaly detection: a log-based error identification tool
Γιαννακοσιάν, Π. Ι. (2026) · University of Thessaly Institutional Repository (University of Thessaly)
Semantic-Aware Log Anomaly Detection and Prediction
Öztürk, B., Eroglu, B., Yetkin, C. D., & İnan, E. (2026) · International Artificial Intelligence and Data Processing Symposium (IDAP) · doi:10.1109/idap71869.2026.11728001
Мельник, О. (2026) · Cybersecurity Education Science Technique
Heinzl, R., & Nissl, M. (2026) · arXiv (Cornell University) · doi:10.48550/arxiv.2610.35151
Too many clients spoil the logs: distributed parsing, aggregation techniques and metricsPreprint
Gómez, A. G., Beck, V., Landauer, M., Wurzenberger, M., Skopik, F., Rauber, A., & Weipp, E. (2026) · arXiv (Cornell University) · doi:10.48550/arxiv.2610.36946
Digital Communications and Networks Large-Scale System Log Anomaly Detection Based on xLSTM
Yan, L., & Yu, M. (2026) · International Conference on Computer Engineering and Application (ICCEA) · doi:10.1109/iccea69962.2026.11743747
Sarak, S., Akman, B., Turkoglu, A. A., Guzelcay, D., Giritli, E. B., Can, Y. S., & Aktaş, M. S. (2026) · International Conference on Computer Science and Engineering (UBMK) · doi:10.1109/ubmk71847.2026.11745179
MGL-log: Multi-modal Gated Linear Transformer for Log Anomaly Detection
Yan, R., Cai, J., & Su, Y. (2026) · International Conference on Computer Systems (ICCS) · doi:10.1109/iccs71313.2026.11739821
The Cost of Waiting in Early Log Anomaly Recognition: Stopping Rules and Evaluation PopulationsPreprint
Li, J., Li, W., & Zhan, J. (2026) · Research Square · doi:10.21203/rs.3.rs-11535197/v1
Priyadharshini, S., Heena, R., & Dharanika, S. (2026) · International Conference on Distributed Systems, Computer Networks and Cybersecurity (ICDSCNC) · doi:10.1109/icdscnc70670.2026.11746257
Akmal, S. Z. R., Fatyanosa, T. N., & Data, M. (2026) · Atlantis Highlights in Computer Sciences/Atlantis highlights in computer sciences · doi:10.2991/978-94-6239-828-3_13
Асилбеков, Т., & Orozov, M. O. (2026) · Bulletin of Osh State University · doi:10.52754/16948610_2026_3_14
Dual-Graph Fusion with Mutual Knowledge Distillation for Log Anomaly Detection
Shan, D., Zhu, S., Cheng, C., Liu, W., Yang, Y., Li, Y., & Chen, C. (2026) · Symmetry · doi:10.3390/sym18111855
Li, X., Ren, R., Li, X., Tang, Y., Ma, J., Chen, J., Li, W., Yan, Z., Xiong, T., & Qu, L. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-7744-5_12
Drift-Aware Multi-Scale Temporal–Logical Scoring for Online Log Anomaly Detection
Garcia, J., & Alvarez, J. (2026) · Jisuanji shenghuojia. · doi:10.54097/fhva6308
Wang, H., Shi, J., Chen, Y., Wang, H., Xiao, Y., & Wang, Y. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-7678-3_1
Morgan-Benita, J. A., Espino-Salinas, C. H., & Chaires, L. A. F. (2026) · doi:10.68744/dqs8cp53/ch10
Metadata
- Authors
- Guo, H., Yuan, S., & Wu, X.
- Affiliations
- Utah State University (US)
- University of Arkansas at Fayetteville (US)
- ORCID
- Wu, Xintao
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2021
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2103.04475
- OpenAlex
- W3134847483
- Cited by
- 7
- References
- 24
- Citations by year
- 2026: 1 · 2024: 2 · 2023: 2 · 2021: 2
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- arXiv (Cornell University) (submittedVersion, cc-by)
- Digital Commons - USU (Utah State University) (submittedVersion)
- arXiv (Cornell University) (cc-by)
- Digital Commons - USU (Utah State University)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Software System Performance and Reliability
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- log anomaly detection, system logs, BERT, self-supervised learning, intrusion detection, cybersecurity
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
