ALPHA: LLM-Enabled Active Learning for Human-Free Network Anomaly Detection

Akruti Sinha; Shivesh Madan Nath Jha; Xuanhao Luo; Yuchen Liu; Zhizhen Li

REVIEW 4 major objections 5 minor 28 references

ALPHA: LLM-Enabled Active Learning for Human-Free Network Anomaly Detection

T0 review · 4 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Cluster-propagated LLM labels match fully supervised log anomaly detectors

desk verdict Sensible new pipeline, but 'zero human annotation' is overstated and the evaluation is single-dataset with no baselines. read the letter →

arxiv 2509.05936 v1 pith:AELVOIDE submitted 2025-09-07 cs.NI cs.LG

Xuanhao Luo , Shivesh Madan Nath Jha , Akruti Sinha , Zhizhen Li , Yuchen Liu This is my paper · ORCID

classification cs.NIcs.LG

keywords loganomalydetectionactivelearninglargelanguagemodelslabelpropagationsemanticembeddingsclusteringhuman-freeannotationnetworklogs

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that the costliest step in network log anomaly detection—labeling training data—can be removed entirely. ALPHA embeds raw log messages into a semantic vector space, clusters them, asks a large language model to label a handful of samples near each cluster center, and propagates that majority-vote label to every member of the cluster. The resulting pseudo-labeled dataset trains lightweight classifiers (SVM, logistic regression) to F1 scores above 95% and 99%, statistically indistinguishable from the same models trained on 5,000 expert labels. The authors claim this makes fully automated, human-free log analysis possible, including LLM-generated root-cause explanations after detection.

What carries the argument

The mechanism is clustering-based active sampling with label propagation. Embeddings from a pretrained transformer encoder are partitioned by k-means (k=15 chosen by elbow and silhouette); the m=5 samples nearest each centroid are LLM-annotated; majority vote fixes the cluster label; that label is assigned to all cluster members. A two-step few-shot refinement tunes the annotation prompt using a small one-time validation set, and a feedback loop retrains the detector if performance falls below a threshold.

What would settle it

Run ALPHA unchanged on a second public log corpus (e.g., BGL or HDFS logs) with no human annotations, and compare the F1 of the trained SVM and logistic regression against the same models trained on that corpus's ground-truth labels. If the gap exceeds what the paper reports on Thunderbird, the human-free claim is corpus-specific rather than general.

Watch

Extended reading notes

Core claim

In the authors' terms, ALPHA is the first active-learning pipeline for human-free log analysis: zero human annotations are needed to train an anomaly detector. The discovery is that cluster-resolved semantic embeddings are a sufficiently strong prior that one LLM majority-vote label per cluster can be propagated to thousands of logs with under five misclassifications per 5,000 samples, and that classifiers trained on these propagated labels match fully supervised performance (SVM above 95% F1, logistic regression above 99% F1 on both balanced and imbalanced test sets). A two-step few-shot refinement sharpens the LLM's annotation by replacing initial examples with misclassified validation cas

Load-bearing premise

The whole pipeline rests on the premise that the embedding space groups normal and anomalous log messages into clusters that are nearly pure; if a new log corpus does not cluster that way, the propagated labels carry systematic errors and detector quality falls.

Editorial extensions

If this is right

Anomaly detectors for network logs can be trained at scale without expert labeling, removing the dominant cost in supervised log analysis.
Classical ML models (SVM, logistic regression) suffice when label noise from propagation is as low as reported; deep detectors are not required for accuracy.
The same pipeline can be retrained on new log streams automatically, since cluster selection is unsupervised and the feedback loop expands the annotated dataset.
The zero-shot LLM root-cause module turns every detection into a human-readable diagnostic, enabling automated incident triage.
Reported annotation cost falls from 5,000 human labels to zero, and from k-by-n for active learning with humans to zero.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Beyond the paper: the key transfer risk is Observation 2—if another log corpus's embeddings do not separate normal from anomalous events into pure clusters, propagation injects systematic noise and the F1 advantage collapses. A direct test is running ALPHA on public log datasets such as BGL or HDFS with no human labels.
Beyond the paper: the two-step few-shot refinement needs a small manually labeled validation set at startup; strictly speaking the pipeline is 'zero human annotation' only after this one-time prompt calibration, and amortizing that cost across datasets is an open question the authors leave implicit.
Beyond the paper: if cluster purity is the bottleneck, one could replace k-means with density-based clustering or add a distance-based abstention rule; the paper's own epsilon sweep in Fig. 7b suggests label flipping is unnecessary, making abstention a natural extension.
Beyond the paper: the cost comparison treats 'zero human annotation' as the headline, but total cost includes paid LLM API calls for labeling and root-cause analysis; a full accounting against low-cost human labeling would sharpen the practical claim.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Dear Colleague,

Read this one because it claims to kill the labeling bottleneck in log anomaly detection. The real contribution is the specific combination: semantic embeddings, k-means clustering, LLM majority-vote annotation of centroid-near samples, and label propagation. That integration is new in this subfield, and the reported F1 numbers on Thunderbird are strong. The two-step few-shot refinement for prompt construction is a sensible engineering idea, and releasing code helps.

The paper does a few things well. It motivates the problem clearly, the t-SNE cluster-label alignment is visually convincing, and the comparison between LLM-propagated and ground-truth-propagated labels in Fig. 7a is a good sanity check. The pipeline is model-agnostic and includes a lightweight RCA module.

Now the soft spots, in proportion. The central claim of 'zero human annotation cost' is contradicted by the paper itself. Section IV-B3 uses a small manually annotated validation set to refine the few-shot prompts, and Section V-B2 sweeps epsilon using a labeled validation set. That is one-time calibration, not zero human cost. It is still a meaningful reduction from 5,000 labels, but the claim should be reframed.

The evaluation is otherwise thin. One dataset, no state-of-the-art baselines like DeepLog or LogBERT, no error bars or multiple runs, and the F1 scores in Table III are identical to three decimal places between ALPHA and human-labeled active learning — that needs an explanation (likely identical predictions from label propagation, but the paper does not say so). The load-bearing premise, Observation 2, is only validated on Thunderbird; if embeddings don't cluster cleanly on other logs, the propagated labels inject systematic noise and the performance could collapse.

None of this is fatal. The soft spots are empirical and addressable. The work deserves a serious referee and likely a revised version with a second dataset, variance reporting, baselines, and an honest annotation-cost accounting.

If you work on log-based anomaly detection, this is worth your time. For a reading group, maybe — good discussion material, but not a must-read.

Recommendation: engage with it, but be precise about the cost claim.

Best

Referee Report

4 major / 5 minor

Summary. The paper proposes ALPHA, an LLM-enabled active learning pipeline for log anomaly detection. Log messages are embedded with text-embedding-ada-002, clustered with k-means, and the m samples nearest each centroid are labeled by GPT-4o using a two-step few-shot refinement; a majority vote determines each cluster's label and this label is propagated to all cluster members. Lightweight classifiers (SVM, LR) are then trained on this augmented dataset, with a feedback loop that collects more data if a performance threshold is not met, and an LLM-based root cause analysis module provides explanations. Experiments on the Thunderbird dataset report F1 scores above 95% for SVM and above 99% for LR, and the paper claims this is achieved at 'zero human annotation cost.'

Significance. If the central claim is sustained, ALPHA would be a practical contribution to automated log analysis: it combines semantic embeddings, cluster-based label propagation, and LLM annotation so that downstream classifiers do not need per-sample human labels. The release of source code, the use of unsupervised cluster-count selection, and the inclusion of an LLM explanation module are positive features. However, the strongest claim—human-free operation—is contradicted by the paper's own description of a manually annotated validation set, and the empirical evidence is limited to one dataset with no error bars and no direct comparison against cited log anomaly detectors or active-learning baselines. The contribution is therefore promising but not yet established at the level claimed.

major comments (4)

[Sec. IV-B3 and Sec. V-B3] The central claim of 'zero human annotation cost' is contradicted by the paper's own text. Sec. IV-B3 states that 'the validation set in this pre-analysis stage is a small but manually annotated subset prepared prior to ALPHA pipeline.' This manually labeled set is used for the two-step few-shot refinement and, in Sec. V-B2, for the epsilon sweep that selects the label-flipping threshold. The reported F1 results in Table III therefore do not come from a fully label-free procedure as literally claimed in the abstract and Sec. V-B3. The claim should be re-scoped, e.g., to 'no per-sample training labels after a one-time calibration set,' and the size and influence of the calibration set should be reported.
[Sec. V-A.2 and Sec. V-B] The empirical evaluation rests entirely on the Thunderbird dataset with a single split, and no error bars or repeated runs are reported. The paper also does not compare against the cited log anomaly detectors (e.g., DeepLog, LogRobust, LogBERT) or the active-learning baselines (AFALog, LogCAE) that motivate the work. This is load-bearing because the whole pipeline depends on Observation 2—that semantic embedding clusters align closely with ground-truth labels—which is only demonstrated on Thunderbird via Fig. 7a. If cluster purity degrades on other log corpora, label propagation injects systematic noise and the claimed F1 levels may not hold. Please add at least one additional dataset (e.g., BGL or HDFS) and report cluster purity and downstream performance, together with variance over multiple runs.
[Sec. V-B2 and Table III] The annotation-cost accounting is internally inconsistent. The text in Sec. V-B2 says majority voting uses 'the top-5 closest points,' while Table III gives the active-learning human-label cost as 'k×n' with an example of '15×1.' If m=5 and k=15, the cost should be 75, not 15. Either the notation is wrong or the experimental setup changed. Please clarify the number of representative samples per cluster used in the final experiments and compute the true human-label cost of the active-learning baseline, so that the comparison with ALPHA's cost is unambiguous.
[Sec. V-B2, Fig. 7b] The epsilon sweep used to decide against label flipping is performed on a 'small labeled validation set.' This is another label-informed design choice that is not part of a purely human-free workflow. Even if one accepts a one-time calibration set, the sensitivity of the final F1 results to this choice—and to the size of the calibration set—should be assessed. As written, the paper's selected hyperparameters are themselves tuned with human labels, which undercuts the generalization claim that ALPHA can be deployed with no human involvement.

minor comments (5)

[Throughout] There are several typos and spacing errors, e.g., 'accuratedata annotators' in the Introduction and 'minimizing' for 'minimizing' in Algorithm 1. A careful proofread is needed.
[Sec. V-B2] Fig. 7a shows misclassification counts that 'remain under 5 across 5,000' but also mentions an outlier around 1,000 samples. Please clarify whether the outlier is included in the 'under 5' statement and report the exact value.
[Sec. V-B3 and Fig. 8] Figure 8 compares three label sources, but the figure caption and legend do not specify line styles or markers clearly. Please make the curves distinguishable in black-and-white and state whether the reported accuracy is averaged over multiple runs.
[Sec. II] The claim that ALPHA is 'the first Active Learning Pipeline for Human-free log Analysis' should be qualified (e.g., 'to our knowledge') and positioned more carefully relative to prior LLM-based log labeling works, including the already cited LogLLM.
[Sec. V-B2] The notation for the number of representative samples switches between n and m; Algorithm 1 uses m, while Table III uses n. Please unify the notation.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: ALPHA's core result is an empirical evaluation against held-out labels; the only notable caveat is that the 'zero human annotation' headline excludes the manually annotated validation set used for prompt calibration.

full rationale

The paper's derivation chain is an empirical pipeline, not a mathematical derivation. Observation 2 (cluster-label alignment) is supported by preliminary t-SNE inspection and later by Fig. 7a, which measures propagation misclassification against ground-truth labels; this is a check of the premise, not a circular restatement. The downstream claim (Sec. V-B3) is that SVM/LR trained on LLM-propagated labels reach >95%/99% F1; those numbers are evaluated on held-out imbalanced and balanced test sets (Table II), so they are not forced by construction. The two-step few-shot refinement uses a manually annotated validation set (Sec. IV-B3) to select prompt examples, and the epsilon sweep (Sec. V-B2) uses the same kind of validation labels; these are calibration steps, and the final test performance is independent. This does make the literal 'zero human annotation cost' claim overstated, because the pipeline as described requires a one-time manually labeled validation subset for prompt refinement and for the epsilon decision. But that is a disclosed accounting/correctness caveat, not a circular derivation: the test F1 values are not equal to the validation labels by construction. No load-bearing self-citations, uniqueness claims, or ansatz-smuggling via citation were found. The main risks are external validity (single dataset, no error bars) rather than circularity.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central pipeline depends on embedding-cluster label alignment, LLM annotation quality, and the legitimacy of using a manually labeled validation set for tuning, none of which is independently verified beyond one dataset.

free parameters (4)

Number of clusters k = 15
Selected by elbow and silhouette analysis on the full unlabeled embedding set (Fig. 6); directly controls label propagation granularity.
Representative samples per cluster m = 5 in Fig. 7a; 1 in Table III (15 x 1)
Algorithm input m; the paper is inconsistent about whether 5 or 1 samples are LLM-annotated and majority-voted.
Label-flip distance threshold epsilon = 51.139 (swept; final pipeline does not flip)
Swept over 0-100 using a labeled validation set (Fig. 7b) to decide whether to flip propagated labels; the final choice is to keep original cluster labels.
Performance threshold tau = not specified or used
Listed as an input to Algorithm 1 but never defined or used; the feedback loop that it controls is not experimentally evaluated.

assumptions (4)

domain assumption Semantic embeddings from text-embedding-ada-002 cluster log messages such that clusters align with ground-truth normal/anomalous labels (Observation 2, Fig. 2).
If clusters are not label-pure, majority-vote label propagation injects systematic noise; this is the load-bearing premise for the labeling strategy.
domain assumption GPT-4o with few-shot prompting, chain-of-thought, and self-reflection annotates logs accurately enough that majority voting corrects residual LLM errors (Sec. IV-B3).
Per-sample accuracy is only 75% F1 (Table I); the pipeline relies on voting and refinement to reach cluster-level accuracy.
domain assumption k-means with k=15 produces clusters pure enough that a single majority-vote label per cluster yields under 5 misclassifications per 5,000 logs (Fig. 7a).
This near-zero propagation error is an empirical observation on Thunderbird, not a proven general property.
ad hoc to paper A small manually labeled validation set can be used to tune prompts and thresholds without invalidating the human-free claim.
The paper excludes this one-time effort from annotation cost, but it requires human labels and contradicts the abstract's no-human-in-the-loop framing.

how reviews work

0 comments

Cite this review

Pith. "Pith review of ALPHA: LLM-Enabled Active Learning for Human-Free Network Anomaly Detection." pith.science (2026). https://pith.science/paper/AELVOIDE

@misc{pith2026250905936,
  author       = {Pith},
  title        = {Pith review of: ALPHA: LLM-Enabled Active Learning for Human-Free Network Anomaly Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AELVOIDE}},
  note         = {Machine review of arXiv:2509.05936}
}

read the original abstract

Network log data analysis plays a critical role in detecting security threats and operational anomalies. Traditional log analysis methods for anomaly detection and root cause analysis rely heavily on expert knowledge or fully supervised learning models, both of which require extensive labeled data and significant human effort. To address these challenges, we propose ALPHA, the first Active Learning Pipeline for Human-free log Analysis. ALPHA integrates semantic embedding, clustering-based representative sampling, and large language model (LLM)-assisted few-shot annotation to automate the anomaly detection process. The LLM annotated labels are propagated across clusters, enabling large-scale training of an anomaly detector with minimal supervision. To enhance the annotation accuracy, we propose a two-step few-shot refinement strategy that adaptively selects informative prompts based on the LLM's observed error patterns. Extensive experiments on real-world log datasets demonstrate that ALPHA achieves detection accuracy comparable to fully supervised methods while mitigating human efforts in the loop. ALPHA also supports interpretable analysis through LLM-driven root cause explanations in the post-detection stage. These capabilities make ALPHA a scalable and cost-efficient solution for truly automated log-based anomaly detection.

Figures

Figures reproduced from arXiv: 2509.05936 by the authors.

**Figure 3.** Overview of ALPHA for closed-loop human-free log analysis. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

**Figure 4.** Transformer encoder for log data embedding. [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗

Figures from the paper (5 more)

**Figure 5.** Figure 5: System and User Prompts used for LLM-based [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]

**Figure 6.** Figure 6: Cluster Optimization Results. illustrated in [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

**Figure 7.** Figure 7: Performance of Cluster-based Labeling. 0 1000 2000 3000 4000 5000 Available Data Size 0.4 0.5 0.6 0.7 0.8 0.9 Accuracy Imbalanced Balanced (a) Supervised learning with labels 0 1000 2000 3000 4000 5000 Available Data Size 0.3 0.4 0.5 0.6 0.7 0.8 0.9 Accuracy Imbalance…

**Figure 8.** Figure 8: Anomaly detection performance with increasing avail [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]

**Figure 9.** Figure 9: Analysis of Anomalous Log Entry. VI. CONCLUSION In this paper, we propose ALPHA, a novel LLM-enabled active learning framework designed to achieve fully human-free log-based anomaly detection and analysis. ALPHA integrates semantic embedding, clustering-based sampling…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

28 extracted references · 10 canonical work pages

[1]

A survey on automated log analysis for reliability engineering,

S. He, P. He, Z. Chen, T. Yang, Y . Su, and M. R. Lyu, “A survey on automated log analysis for reliability engineering,”ACM computing surveys (CSUR), vol. 54, no. 6, pp. 1–37, 2021

2021
[2]

Deep learning for anomaly detection in log data: A survey,

M. Landauer, S. Onder, F. Skopik, and M. Wurzenberger, “Deep learning for anomaly detection in log data: A survey,”Machine Learning with Applications, vol. 12, p. 100470, 2023

2023
[3]

Active learning literature survey,

B. Settles, “Active learning literature survey,”University of Wisconsin- Madison Department of Computer Sciences, 2009

work page 2009
[4]

System log clustering approaches for cyber security applications: A survey,

M. Landauer, F. Skopik, M. Wurzenberger, and A. Rauber, “System log clustering approaches for cyber security applications: A survey,” Computers & Security, vol. 92, p. 101739, 2020

work page 2020
[5]

A data clustering algorithm for mining patterns from event logs,

R. Vaarandi, “A data clustering algorithm for mining patterns from event logs,” inProceedings of the 3rd IEEE Workshop on IP Operations & Management (IPOM 2003). Ieee, 2003, pp. 119–126

work page 2003
[6]

Drain: An online log parsing approach with fixed depth tree,

P. He, J. Zhu, Z. Zheng, and M. R. Lyu, “Drain: An online log parsing approach with fixed depth tree,” in2017 IEEE international conference on web services (ICWS). IEEE, 2017, pp. 33–40

2017
[7]

Dynamic log file analysis: An unsupervised cluster evolution approach for anomaly detection,

M. Landauer, M. Wurzenberger, F. Skopik, G. Settanni, and P. Filzmoser, “Dynamic log file analysis: An unsupervised cluster evolution approach for anomaly detection,”computers & security, vol. 79, pp. 94–116, 2018

work page 2018
[8]

Robust log-based anomaly detection on unstable log data,

X. Zhang, Y . Xu, Q. Lin, B. Qiao, H. Zhang, Y . Dang, C. Xie, X. Yang, Q. Cheng, Z. Liet al., “Robust log-based anomaly detection on unstable log data,” inProceedings of the 2019 27th ACM joint meeting on European software engineering conference and symposium on the foundations of software engineering, 2019, pp. 807–817

2019

Show all 28 references

[9]

Log-based anomaly detection without log pars- ing,

V .-H. Le and H. Zhang, “Log-based anomaly detection without log pars- ing,” in2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 2021, pp. 492–504

2021
[10]

Logllm: Log- based anomaly detection using large language models,

W. Guan, J. Cao, S. Qian, J. Gao, and C. Ouyang, “Logllm: Log- based anomaly detection using large language models,”arXiv preprint arXiv:2411.08561, 2024

2024 arXiv
[11]

Logbert: Log anomaly detection via bert,

H. Guo, S. Yuan, and X. Wu, “Logbert: Log anomaly detection via bert,” in2021 international joint conference on neural networks (IJCNN). IEEE, 2021, pp. 1–8

2021
[12]

Afalog: A general augmentation framework for log-based anomaly detection with active learning,

C. Duan, T. Jia, H. Cai, Y . Li, and G. Huang, “Afalog: A general augmentation framework for log-based anomaly detection with active learning,” in2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE). IEEE, 2023, pp. 46–56

2023
[13]

Logcae: An approach for log-based anomaly detection with active learning and contrastive learning,

P. Xiao, T. Jia, C. Duan, H. Cai, Y . Li, and G. Huang, “Logcae: An approach for log-based anomaly detection with active learning and contrastive learning,” in2024 IEEE 35th International Symposium on Software Reliability Engineering (ISSRE). IEEE, 2024, pp. 144–155

2024
[14]

Consistency-based semi-supervised active learning: Towards min- imizing labeling cost,

M. Gao, Z. Zhang, G. Yu, S. ¨O. Arık, L. S. Davis, and T. Pfis- ter, “Consistency-based semi-supervised active learning: Towards min- imizing labeling cost,” inEuropean Conference on Computer Vision. Springer, 2020, pp. 510–526

2020
[15]

Gpt-4o system card,

A. Hurst, A. Lerer, A. P. Goucher, A. Perelman, A. Ramesh, A. Clark, A. Ostrow, A. Welihinda, A. Hayes, A. Radfordet al., “Gpt-4o system card,”arXiv preprint arXiv:2410.21276, 2024

2024 arXiv
[16]

Attention is all you need,

A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,”Advances in neural information processing systems, vol. 30, 2017

2017
[17]

NetSight: Graph attention based traffic forecasting in computer net- works,

J. Xing, G. Sun, H. Sun, L. Pan, S. Mahmood, X. Luo, and M. Shahzad, “NetSight: Graph attention based traffic forecasting in computer net- works,”arXiv preprint arXiv:2505.07034, 2025

2025 arXiv
[18]

Rank-based modeling for universal packets compression in multi-modal communications,

X. Luo, Z. Peng, Z. Li, R. Yu, and Y . Liu, “Rank-based modeling for universal packets compression in multi-modal communications,” in2025 IEEE 26th International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM). IEEE, 2025, pp. 249–258

2025
[19]

BFMLoc: Transformer- based indoor positioning leveraging beamforming feedback matrices,

Z. Li, X. Luo, M. Chen, C. Xu, and Y . Liu, “BFMLoc: Transformer- based indoor positioning leveraging beamforming feedback matrices,” in IEEE International Conference on Communications, to appear. IEEE, 2025

2025
[20]

Queries and concept learning,

D. Angluin, “Queries and concept learning,”Machine learning, vol. 2, pp. 319–342, 1988

1988
[21]

Improving generalization with active learning,

D. Cohn, L. Atlas, and R. Ladner, “Improving generalization with active learning,”Machine learning, vol. 15, pp. 201–221, 1994

1994
[22]

A sequential algorithm for training text classifiers: Corrigendum and additional data,

D. D. Lewis, “A sequential algorithm for training text classifiers: Corrigendum and additional data,” inAcm Sigir Forum, vol. 29, no. 2. ACM New York, NY , USA, 1995, pp. 13–19

1995
[23]

Deep learning or classical machine learning? an empirical study on log-based anomaly detection,

B. Yu, J. Yao, Q. Fu, Z. Zhong, H. Xie, Y . Wu, Y . Ma, and P. He, “Deep learning or classical machine learning? an empirical study on log-based anomaly detection,” inProceedings of the 46th IEEE/ACM International Conference on Software Engineering, 2024, pp. 1–13

2024
[24]

Term-weighting approaches in automatic text retrieval,

G. Salton and C. Buckley, “Term-weighting approaches in automatic text retrieval,”Information processing & management, vol. 24, no. 5, pp. 513–523, 1988

1988
[25]

Bert: Pre-training of deep bidirectional transformers for language understanding,

J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” inPro- ceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technolog...

2019
[26]

Roberta: A robustly optimized bert pretraining approach,

Y . Liu, M. Ott, N. Goyal, J. Du, M. Joshi, D. Chen, O. Levy, M. Lewis, L. Zettlemoyer, and V . Stoyanov, “Roberta: A robustly optimized bert pretraining approach,”arXiv preprint arXiv:1907.11692, 2019

1907 arXiv
[27]

Text and code embeddings by contrastive pre-training. arxiv 2022,

A. Neelakantan, T. Xu, R. Puri, A. Radford, J. M. Han, J. Tworek, Q. Yuan, N. Tezak, J. W. Kim, C. Hallacyet al., “Text and code embeddings by contrastive pre-training. arxiv 2022,”arXiv preprint arXiv:2201.10005, 2022

2022 arXiv
[28]

What supercomputers say: A study of five system logs,

A. Oliner and J. Stearley, “What supercomputers say: A study of five system logs,” in37th annual IEEE/IFIP international conference on dependable systems and networks (DSN’07). IEEE, 2007, pp. 575– 584

2007

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.

[1] [1]

A survey on automated log analysis for reliability engineering,

S. He, P. He, Z. Chen, T. Yang, Y . Su, and M. R. Lyu, “A survey on automated log analysis for reliability engineering,”ACM computing surveys (CSUR), vol. 54, no. 6, pp. 1–37, 2021

2021

[2] [2]

Deep learning for anomaly detection in log data: A survey,

M. Landauer, S. Onder, F. Skopik, and M. Wurzenberger, “Deep learning for anomaly detection in log data: A survey,”Machine Learning with Applications, vol. 12, p. 100470, 2023

2023

[3] [3]

Active learning literature survey,

B. Settles, “Active learning literature survey,”University of Wisconsin- Madison Department of Computer Sciences, 2009

work page 2009

[4] [4]

System log clustering approaches for cyber security applications: A survey,

M. Landauer, F. Skopik, M. Wurzenberger, and A. Rauber, “System log clustering approaches for cyber security applications: A survey,” Computers & Security, vol. 92, p. 101739, 2020

work page 2020

[5] [5]

A data clustering algorithm for mining patterns from event logs,

R. Vaarandi, “A data clustering algorithm for mining patterns from event logs,” inProceedings of the 3rd IEEE Workshop on IP Operations & Management (IPOM 2003). Ieee, 2003, pp. 119–126

work page 2003

[6] [6]

Drain: An online log parsing approach with fixed depth tree,

P. He, J. Zhu, Z. Zheng, and M. R. Lyu, “Drain: An online log parsing approach with fixed depth tree,” in2017 IEEE international conference on web services (ICWS). IEEE, 2017, pp. 33–40

2017

[7] [7]

Dynamic log file analysis: An unsupervised cluster evolution approach for anomaly detection,

M. Landauer, M. Wurzenberger, F. Skopik, G. Settanni, and P. Filzmoser, “Dynamic log file analysis: An unsupervised cluster evolution approach for anomaly detection,”computers & security, vol. 79, pp. 94–116, 2018

work page 2018

[8] [8]

Robust log-based anomaly detection on unstable log data,

X. Zhang, Y . Xu, Q. Lin, B. Qiao, H. Zhang, Y . Dang, C. Xie, X. Yang, Q. Cheng, Z. Liet al., “Robust log-based anomaly detection on unstable log data,” inProceedings of the 2019 27th ACM joint meeting on European software engineering conference and symposium on the foundations of software engineering, 2019, pp. 807–817

2019