Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

Practitioners' Expectations on Log Anomaly Detection

T0 review · 4 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Automated log anomaly detection research is optimizing for the wrong outcomes: it delivers accuracy but not the interpretability, customization, and privacy practitioners say they need.

desk verdict First real map of practitioner expectations for log anomaly detection, with concrete adoption thresholds; the gap analysis is more judgment-call than the authors let on, but the central finding holds up. read the letter →

arxiv 2412.01066 v1 pith:OBMXMFUK submitted 2024-12-02 cs.SE

Xiaoxue Ma , Yishu Li , Jacky Keung , Xiao Yu , Huiqi Zou , Zhen Yang , Federica Sarro , Earl T. Barr This is my paper · ORCID
classification cs.SE
keywords loganomalydetectionpractitioners'expectationsempiricalsurveyliteraturereviewinterpretabilitycustomizationprivacyprotectionsoftwaremaintenance
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that there is a large gap between what software practitioners want from automated log anomaly detection and what a decade of research has delivered. It bases this claim on a survey of 312 practitioners from 36 countries and a structured review of 36 papers from premier venues published from 2014 to 2024. The central numbers: 95.5% of practitioners call automated tools essential or worthwhile; 84.5% require interpretability and 78.2% require customization, yet only one reviewed paper offers interpretable output and none offer customization or privacy protection. More than 74% of practitioners report that metrics and traces are available, but only four reviewed studies use them. If the paper is right, benchmark-driven accuracy gains are not enough: adoption depends on factors the literature has mostly skipped, and research should shift toward interpretable, generalizable, customizable, privacy-aware, and user-friendly tools.

What carries the argument

The machinery is a three-stage mixed-methods design: (1) 15 semi-structured interviews with professionals produce a set of issues and expectations; (2) an online survey of 312 practitioners turns those into percentages and minimum thresholds; (3) a structured literature review of 36 papers from premier venues (2014-2024) rates each technique against nine factors—data resource, granularity, effectiveness (recall and precision), efficiency, scalability, interpretability, generalizability, customization, and privacy protection—using the comparison table as the central instrument. The satisfaction-rate column is the load-bearing device: for any capability range a paper reports, the authors look up what percentage of surveyed practitioners would accept that level, converting research capabilities into adoption likelihoods.

What would settle it

A replication that samples practitioners through a probability-based method instead of professional networks and open-source contributor emails, and finds that only a minority value interpretability and customization, would undercut the claimed gap; equally, a re-review of the same venues with the same inclusion criteria that located many papers offering rationales, customization, or privacy protections would show the gap is smaller than reported.

Watch

Extended reading notes

Core claim

The paper's central claim, stated in its own terms, is that current automated log anomaly detection research does not meet practitioners' expectations, and the mismatch is systematic. Across nine comparison dimensions, the review finds that most techniques perform well only on the dimensions practitioners care least about as adoption gatekeepers: 30 of 36 papers report recall in the 80-100% range and 26 report precision there, satisfying all surveyed practitioners, while interpretability, customization, and privacy protection—valued by 84.5%, 78.2%, and 66.6% respectively—are addressed by one paper, no papers, and no papers. The paper also reports a data-availability mismatch: 88.9% of studies train on historical labeled normal logs, yet only 39.3% of practitioners always have that data, whereas metrics and traces are available to at least 74% and used by only four studies. The paper's overall conclusion is that accuracy on public benchmarks is necessary but not sufficient for adoption.

Load-bearing premise

The load-bearing premise is that the 312 practitioners recruited through the authors' professional networks and emails to open-source contributors represent software practitioners generally, so the reported percentages (95.5% importance, 84.5% interpretability, 78.2% customization) hold beyond this convenience sample.

Editorial extensions

If this is right

  • Researchers should prioritize interpretable output; currently 1 of 36 reviewed papers provides a rationale for detected anomalies, while 84.5% of practitioners say interpretability shapes their acceptance.
  • The reviewed techniques should incorporate metrics and traces, since at least 74% of practitioners have such data available but only 4 of 36 studies use them.
  • Customization and privacy protection, with zero coverage in the reviewed literature, are adoption conditions for 78.2% and 66.6% of practitioners, so tool-building efforts need to address them.
  • Detection-time reporting needs to become standard: 63.9% of reviewed papers do not report anomaly detection time, while roughly 80% of practitioners want detection within one minute.
  • Cross-project generalizability deserves evaluation as a first-class property: only 4 of 36 papers test across domains, yet 83.8% of practitioners expect tools to handle diverse log structures.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: because practitioners already have metrics and traces, a natural next step is to benchmark multi-modal detectors that consume logs plus metrics and traces; the review suggests only a handful of techniques currently do this.
  • Beyond the paper: the complete absence of customization and privacy in the reviewed literature implies that public benchmarks reward only accuracy; adding adoption-oriented metrics such as time-to-explain, configurability, and data-protection guarantees would test whether these properties can be engineered into detectors.
  • Beyond the paper: practitioners want rationales integrated into existing tools rather than as add-ons, which points to LLM-based explanation as a concrete direction: generate natural-language rationales for flagged logs and measure whether they cut manual investigation time, not just whether practitioners say they like them.
  • Beyond the paper: the finding that about half of practitioners still would not prioritize research techniques despite high reported accuracy suggests that offline F1 gains may not transfer to industry; field deployments that track adoption decisions would be the direct test.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper reports a mixed-methods empirical study: 15 semi-structured interviews and a survey of 312 practitioners from 36 countries, followed by a literature review of 36 log anomaly detection papers from 2014–2024. The authors compare practitioners' expectations (granularity, effectiveness, efficiency, scalability, interpretability, generalizability, customization, privacy) with the capabilities of the reviewed papers, concluding that current research largely meets accuracy and scalability expectations but underdelivers on interpretability, generalizability, customization, and privacy. The main contribution is a descriptive map of practitioner expectations and a gap analysis against recent research.

Significance. If the RQ4 comparison is made auditable, the paper provides a useful and timely resource for the log analysis community: it quantifies practitioner thresholds (e.g., 95.5% view automated tools as essential or worthwhile, 70.5% prefer sequence-level analysis, 84.5% demand interpretability) and highlights under-addressed design dimensions. The survey design is carefully reported: pilot testing, interview coding with Cohen's kappa = 0.72, a publicly accessible survey instrument, explicit inclusion criteria, and snowballing for the literature review. The practitioner-expectation findings are likely to influence future tool and technique design. However, the literature-review comparison in RQ4 has methodological gaps—notably the lack of an auditable coding rubric—that must be addressed before the central gap claims can be fully accepted.

major comments (4)
  1. [Section II-C, Table I, Finding 10] The central claim that only one of 36 papers supports interpretability and none support customization or privacy rests on binary capability coding by two authors with no reported inter-rater reliability, no coding rubric, and no per-paper evidence trail, in contrast to the interview coding which reports Cohen's kappa = 0.72. Because the survey defines customization to include 'adapting thresholds for defining anomalies' (Section II-B1), the conclusion that zero papers support customization is not self-evident for threshold-based detectors and requires an explicit coding justification. The authors should provide an appendix or online repository with the coding rubric, example codings, and a per-paper justification list, and report agreement (e.g., Cohen's kappa) for the Stage 3 coding.
  2. [Section III-D, 'Challenges of adopting existing log anomaly detection techniques'] The statement that 'around half of the surveyed practitioners (51%) do not prioritize these techniques' reuses the 51% compatibility-issue statistic from Figure 4, which was reported as an issue with existing log monitoring tools, not as a reason to deprioritize research techniques. This reuses a different quantity and does not support the sentence. Please either report the actual percentage derived from the free-text concerns (categorized as 26X, 19X, and 12X) or rephrase the sentence to refer directly to the survey question about willingness to use deep-learning-based techniques.
  3. [Section III-D, Scalability] Scalability satisfaction is inferred from the size of the evaluation dataset (e.g., '35 papers ... evaluated ... on a public dataset containing more than 1,000,000 logs'), but the survey defines scalability as the capacity to process a specified number of logs while maintaining accurate and timely detection (Section II-B1). Dataset size is not a measurement of a technique's throughput or capacity; a paper may evaluate on HDFS without reporting end-to-end processing time or memory behavior at that scale. The comparison should be re-framed as 'evaluated on datasets with at least 1M logs,' or the authors should identify actual scalability measurements in the reviewed papers.
  4. [Section III-D, Data Resource and Finding 9] Finding 9 states that 89% of studies rely on historical labeled normal log data and contrasts this with 'surveyed data availability (39.3%)'. However, 39.3% is the proportion of practitioners for whom such data are 'always' available; adding the 'sometimes' responses gives roughly 80% (Section III-A, Figure 3). The paper itself uses the 'sometimes or always' interpretation in Finding 3. Using only the 'always' figure in RQ4 makes the gap appear larger than the survey supports. Please use a consistent availability definition or justify why 'always' is the relevant threshold for training-data availability.
minor comments (5)
  1. [Section III-C, first paragraph] There is a typo in 'log aonmlay detection' (should be 'log anomaly detection') in the paragraph introducing RQ3; please correct.
  2. [Section III-C, Finding 6] Finding 6 states that 'more than 78% of surveyed practitioners consider using automated log anomaly detection tools if they can be customized to process logs with different structures and provide a rationale for the detected anomalies,' but the underlying Figure 7 reports 78.2% for customization, 83.8% for generalizability, and 84.5% for interpretability as separate factors. The 'more than 78%' applies only to customization alone, not to the conjunction, so the finding as worded is misleading.
  3. [Section II-C, Literature search] The search protocol would be easier to reproduce if the authors reported the date of the search, the number of hits per database, and a flow diagram or table showing how the 88 initial papers were reduced to 24 and then to the final 36; the current textual description is clear but lacks these quantitative search details.
  4. [Table I, Effectiveness footnotes] For papers [33], [50], and [47], the table marks recall/precision as '?' but footnote 1 says their F1 values are 'likely to be in the 80-100% range.' This speculation conflicts with the 'unknown' classification; either remove the 'likely' phrase or place those papers in the 80-100% bin.
  5. [Title and Section IV-B] The title and several conclusions speak broadly of 'practitioners' expectations,' but the sample is a self-selected convenience sample (professional networks plus GitHub contributors) as acknowledged in Section IV-B. Adding a consistent hedge such as 'surveyed practitioners' in the title and key conclusions would more accurately reflect the external-validity limits the authors themselves state.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: practitioner expectations and literature capabilities are independently measured and compared.

full rationale

This paper is an empirical mixed-methods study, not a derivation chain. The central gap claim rests on two independent evidence sources: (i) a survey/interview eliciting practitioners' expectations, thresholds, and preferences, and (ii) a manually coded literature review of 36 papers' reported capabilities. The comparison in Table I juxtaposes practitioner satisfaction rates with paper-level capabilities; no quantity is defined in terms of a fitted parameter, and no capability score is derived from the survey responses or vice versa. The coding of papers into capability bins (e.g., interpretability, customization, privacy) is a judgment call, but it is an external categorization applied to the papers, not a prediction forced by the survey data. The acknowledged sample representativeness limitation (Section IV-B) is a validity threat, not circularity, and the absence of inter-rater agreement reporting for the Stage 3 coding is a reproducibility concern, not a circular one. No self-citation carries the load: the methodology cites prior surveys for process only, and the findings are supported by the collected data. The paper is therefore self-contained with respect to circularity concerns.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

No numeric free parameters are fitted. The central conclusions rest on four methodological assumptions: sample representativeness, self-report validity, venue-based literature coverage, and the validity of inferring paper capabilities. No new entities are postulated.

assumptions (4)
  • domain assumption The 312 survey respondents, recruited via personal networks and GitHub contributor emails, represent the broader population of software practitioners.
    Section II-B2 describes convenience sampling with a low response rate (236 valid from 9,933 emailed, plus 76 from networks); the paper's percentage claims (e.g., 95.5%, 70.5%) generalize only if this assumption holds.
  • domain assumption Practitioners' self-reported data availability and tool behaviors accurately reflect real workplace conditions.
    Section II-B1 relies on self-report for data availability, tool usage, and issues; no independent verification is performed.
  • domain assumption Restricting the literature review to CORE A/A* conferences and JCR Q1 journals captures the current state of the art in log anomaly detection.
    Section II-C defines premier venues this way; non-premier but influential venues are excluded, which could bias the gap analysis.
  • domain assumption Inferring each paper's granularity, effectiveness, efficiency, and scalability from its reported evaluation is a valid basis for comparing with survey satisfaction rates.
    Section II-C states the authors infer capabilities (e.g., grouping strategies, satisfaction rates) from reading papers; some papers are marked '?' where metrics are unknown.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Practitioners' Expectations on Log Anomaly Detection." pith.science (2026). https://pith.science/paper/OBMXMFUK

@misc{pith2026241201066,
  author       = {Pith},
  title        = {Pith review of: Practitioners' Expectations on Log Anomaly Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OBMXMFUK}},
  note         = {Machine review of arXiv:2412.01066}
}
read the original abstract

Log anomaly detection has become a common practice for software engineers to analyze software system behavior. Despite significant research efforts in log anomaly detection over the past decade, it remains unclear what are practitioners' expectations on log anomaly detection and whether current research meets their needs. To fill this gap, we conduct an empirical study, surveying 312 practitioners from 36 countries about their expectations on log anomaly detection. In particular, we investigate various factors influencing practitioners' willingness to adopt log anomaly detection tools. We then perform a literature review on log anomaly detection, focusing on publications in premier venues from 2014 to 2024, to compare practitioners' needs with the current state of research. Based on this comparison, we highlight the directions for researchers to focus on to develop log anomaly detection techniques that better meet practitioners' expectations.

Figures

Figures reproduced from arXiv: 2412.01066 by the authors.

Figure 1
Figure 1. The overview of the research methodology. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The percentages of tool usage for log anomaly detec [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Data resource availability for log anomaly detection. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: The current issues with log monitoring tools for log anomaly detection. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: The importance of automated log anomaly detection [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: The granularity of automated log anomaly detection [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 9
Figure 9. Figure 9: The surveyed practitioners’ satisfaction rate with vari [PITH_FULL_IMAGE:figures/full_fig_p007_9.png]
Figure 10
Figure 10. Figure 10: The surveyed practitioners’ satisfaction in terms of [PITH_FULL_IMAGE:figures/full_fig_p008_10.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Beyond Window-Based Detection: A Graph-Centric Framework for Discrete Log Anomaly Detection

    cs.SE 2025-01 conditional novelty 6.0 of 10

    TempoLog replaces fixed-size log windows with continuous-time dynamic graphs and link prediction to detect anomalies at individual event level.

Reference graph

Works this paper leans on

68 extracted references · 43 canonical work pages · cited by 1 Pith paper

  1. [1]

    Using evolutionary annotations from change logs to enhance program comprehension,

    D. M. German, P. C. Rigby, and M.-A. Storey, “Using evolutionary annotations from change logs to enhance program comprehension,” in Proceedings of the 2006 international workshop on Mining software repositories, 2006, pp. 159–162

    work page 2006

  2. [2]

    On the temporal relations between logging and code,

    Z. Ding, Y . Tang, Y . Li, H. Li, and W. Shang, “On the temporal relations between logging and code,” in 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE) . IEEE, 2023, pp. 843– 854

    work page 2023

  3. [3]

    Log-based anomaly detection without log parsing,

    Le, Van-Hoang and Zhang, Hongyu, “Log-based anomaly detection without log parsing,” in 2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE) . IEEE, 2021, pp. 492–504

    work page 2021

  4. [4]

    Loganomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs

    W. Meng, Y . Liu, Y . Zhu, S. Zhang, D. Pei, Y . Liu, Y . Chen, R. Zhang, S. Tao, P. Sunet al., “Loganomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs.” in IJCAI, vol. 19, no. 7, 2019, pp. 4739–4745

    2019

  5. [5]

    Heteroge- neous anomaly detection for software systems via semi-supervised cross- modal attention,

    C. Lee, T. Yang, Z. Chen, Y . Su, Y . Yang, and M. R. Lyu, “Heteroge- neous anomaly detection for software systems via semi-supervised cross- modal attention,” in 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE) . IEEE, 2023, pp. 1724–1736

    work page 2023

  6. [6]

    Deeplog: Anomaly detection and diagnosis from system logs through deep learning,

    M. Du, F. Li, G. Zheng, and V . Srikumar, “Deeplog: Anomaly detection and diagnosis from system logs through deep learning,” in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communica- tions Security (CCS) , 2017, pp. 1285–1298

    work page 2017

  7. [7]

    Pathidea: Improving information retrieval-based bug localization by re-constructing execution paths using logs,

    A. R. Chen, T.-H. Chen, and S. Wang, “Pathidea: Improving information retrieval-based bug localization by re-constructing execution paths using logs,” IEEE Transactions on Software Engineering , vol. 48, no. 8, pp. 2905–2919, 2021

    work page 2021

  8. [8]

    Latent error prediction and fault localization for microservice applications by learning from system trace logs,

    X. Zhou, X. Peng, T. Xie, J. Sun, C. Ji, D. Liu, Q. Xiang, and C. He, “Latent error prediction and fault localization for microservice applications by learning from system trace logs,” in Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, 2019, pp. 683–694

    2019

Show all 68 references
  1. [9]

    Deep learning or classical machine learning? an empirical study on log-based anomaly detection,

    B. Yu, J. Yao, Q. Fu, Z. Zhong, H. Xie, Y . Wu, Y . Ma, and P. He, “Deep learning or classical machine learning? an empirical study on log-based anomaly detection,” in Proceedings of the 46th IEEE/ACM International Conference on Software Engineering , 2024, pp. 1–13

    2024

  2. [10]

    Log-based anomaly detection with deep learning: How far are we?

    V .-H. Le and H. Zhang, “Log-based anomaly detection with deep learning: How far are we?” in Proceedings of the 44th international conference on software engineering , 2022, pp. 1356–1367

    2022

  3. [11]

    Leavy, Research design: Quantitative, qualitative, mixed methods, arts-based, and community-based participatory research approaches

    P. Leavy, Research design: Quantitative, qualitative, mixed methods, arts-based, and community-based participatory research approaches . Guilford Publications, 2022

    2022

  4. [12]

    Spencer, Card sorting: Designing usable categories

    D. Spencer, Card sorting: Designing usable categories . Rosenfeld Media, 2009

    2009

  5. [13]

    Google forms,

    “Google forms,” https://docs.google.com/forms, 2024

    2024

  6. [14]

    Survey form,

    “Survey form,” https://figshare.com/articles/online resource/Survey/ 25981564, 2024, [Online]

    2024

  7. [15]

    Wenjuanxing software,

    “Wenjuanxing software,” https://www.wjx.cn, 2024

    2024

  8. [16]

    A survey of per- formance optimization for mobile applications,

    M. Hort, M. Kechagia, F. Sarro, and M. Harman, “A survey of per- formance optimization for mobile applications,” IEEE Transactions on Software Engineering, vol. 48, no. 8, pp. 2879–2904, 2021

    2021

  9. [17]

    On the use of evaluation measures for defect prediction studies,

    R. Moussa and F. Sarro, “On the use of evaluation measures for defect prediction studies,” in Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis , 2022, pp. 101–113

    2022

  10. [18]

    Guidelines for snowballing in systematic literature studies and a replication in software engineering,

    C. Wohlin, “Guidelines for snowballing in systematic literature studies and a replication in software engineering,” in Proceedings of the 18th international conference on evaluation and assessment in software engineering, 2014, pp. 1–10

    2014

  11. [19]

    Logformer: A pre-train and tuning pipeline for log anomaly detection,

    H. Guo, J. Yang, J. Liu, J. Bai, B. Wang, Z. Li, T. Zheng, B. Zhang, J. Peng, and Q. Tian, “Logformer: A pre-train and tuning pipeline for log anomaly detection,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 38, no. 1, 2024, pp. 135–143

    2024

  12. [20]

    Onelog: towards end-to-end software log anomaly detection,

    S. Hashemi and M. M ¨antyl¨a, “Onelog: towards end-to-end software log anomaly detection,” Automated Software Engineering , vol. 31, no. 2, p. 37, 2024

    2024

  13. [21]

    Logsd: Detecting anomalies from system logs through self-supervised learning and frequency-based masking,

    Y . Xie, H. Zhang, and M. A. Babar, “Logsd: Detecting anomalies from system logs through self-supervised learning and frequency-based masking,” arXiv preprint arXiv:2404.11294 , 2024

    2024 arXiv

  14. [22]

    Metalog: Generalizable cross-system anomaly detection from logs with meta-learning,

    C. Zhang, T. Jia, G. Shen, P. Zhu, and Y . Li, “Metalog: Generalizable cross-system anomaly detection from logs with meta-learning,” in Pro- ceedings of the IEEE/ACM 46th International Conference on Software Engineering, 2024, pp. 1–12

    2024

  15. [23]

    Semi- supervised and unsupervised anomaly detection by mining numerical workflow relations from system logs,

    B. Zhang, H. Zhang, V .-H. Le, P. Moscato, and A. Zhang, “Semi- supervised and unsupervised anomaly detection by mining numerical workflow relations from system logs,” Automated Software Engineering, vol. 30, no. 1, p. 4, 2023

    2023

  16. [24]

    Logonline: A semi-supervised log-based anomaly detector aided with online learning mechanism,

    X. Wang, J. Song, X. Zhang, J. Tang, W. Gao, and Q. Lin, “Logonline: A semi-supervised log-based anomaly detector aided with online learning mechanism,” in 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE) . IEEE, 2023, pp. 141–152

    2023

  17. [25]

    Twin graph-based anomaly detection via attentive multi-modal learning for microservice system,

    J. Huang, Y . Yang, H. Yu, J. Li, and X. Zheng, “Twin graph-based anomaly detection via attentive multi-modal learning for microservice system,” in 2023 38th IEEE/ACM International Conference on Auto- mated Software Engineering (ASE) . IEEE, 2023, pp. 66–78

    2023

  18. [26]

    Loader: A log anomaly detector based on transformer,

    T. Xiao, Z. Quan, Z.-J. Wang, Y . Le, Y . Du, X. Liao, K. Li, and K. Li, “Loader: A log anomaly detector based on transformer,” IEEE Transactions on Services Computing , 2023

    2023

  19. [27]

    Mlog: Mogrifier lstm-based log anomaly detection approach using semantic representation,

    Y . Fu, K. Liang, and J. Xu, “Mlog: Mogrifier lstm-based log anomaly detection approach using semantic representation,” IEEE Transactions on Services Computing , 2023

    2023

  20. [28]

    Autolog: A log sequence synthesis framework for anomaly detection,

    Y . Huo, Y . Li, Y . Su, P. He, Z. Xie, and M. R. Lyu, “Autolog: A log sequence synthesis framework for anomaly detection,” in 2023 38th IEEE/ACM International Conference on Automated Software Engineer- ing (ASE). IEEE, 2023, pp. 497–509

    2023

  21. [29]

    Deepuserlog: Deep anomaly detection on user log using semantic analysis and key-value data,

    W. Wang, S. Lu, J. Luo, and C. Wu, “Deepuserlog: Deep anomaly detection on user log using semantic analysis and key-value data,” in 2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE). IEEE, 2023, pp. 172–182

    2023

  22. [30]

    Logrep: Log-based anomaly detection by representing both semantic and numeric informa- tion in raw messages,

    X. Xie, S. Jian, C. Huang, F. Yu, and Y . Deng, “Logrep: Log-based anomaly detection by representing both semantic and numeric informa- tion in raw messages,” in 2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE) . IEEE, 2023, pp. 194–206

    2023

  23. [31]

    Sialog: detecting anomalies in software execution logs using the siamese network,

    S. Hashemi and M. M ¨antyl¨a, “Sialog: detecting anomalies in software execution logs using the siamese network,” Automated Software Engi- neering, vol. 29, no. 2, p. 61, 2022

    2022

  24. [32]

    Deeptralog: Trace-log combined microservice anomaly de- tection through graph-based deep learning,

    C. Zhang, X. Peng, C. Sha, K. Zhang, Z. Fu, X. Wu, Q. Lin, and D. Zhang, “Deeptralog: Trace-log combined microservice anomaly de- tection through graph-based deep learning,” in Proceedings of the 44th International Conference on Software Engineering , 2022, pp. 623–634

    2022

  25. [33]

    An empirical investigation of practical log anomaly detection for online service systems,

    N. Zhao, H. Wang, Z. Li, X. Peng, G. Wang, Z. Pan, Y . Wu, Z. Feng, X. Wen, W. Zhang et al. , “An empirical investigation of practical log anomaly detection for online service systems,” in Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference an...

    2021

  26. [34]

    Semi-supervised log-based anomaly detection via probabilistic label estimation,

    L. Yang, J. Chen, Z. Wang, W. Wang, J. Jiang, X. Dong, and W. Zhang, “Semi-supervised log-based anomaly detection via probabilistic label estimation,” in 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE) . IEEE, 2021, pp. 1448–1460

    2021

  27. [35]

    Logflash: Real-time streaming anomaly detection and diagnosis from system logs for large-scale software systems,

    T. Jia, Y . Wu, C. Hou, and Y . Li, “Logflash: Real-time streaming anomaly detection and diagnosis from system logs for large-scale software systems,” in 2021 IEEE 32nd International Symposium on Software Reliability Engineering (ISSRE) . IEEE, 2021, pp. 80–90

    2021

  28. [36]

    Logtransfer: Cross-system log anomaly detection for software systems with transfer learning,

    R. Chen, S. Zhang, D. Li, Y . Zhang, F. Guo, W. Meng, D. Pei, Y . Zhang, X. Chen, and Y . Liu, “Logtransfer: Cross-system log anomaly detection for software systems with transfer learning,” in2020 IEEE 31st International Symposium on Software Reliability Engineering (ISSRE) . ...

    2020

  29. [37]

    Swisslog: Robust and unified deep learning based log anomaly detection for diverse faults,

    X. Li, P. Chen, L. Jing, Z. He, and G. Yu, “Swisslog: Robust and unified deep learning based log anomaly detection for diverse faults,” in 2020 IEEE 31st International Symposium on Software Reliability Engineering (ISSRE). IEEE, 2020, pp. 92–103

    2020

  30. [38]

    Robust log-based anomaly detection on unstable log data,

    X. Zhang, Y . Xu, Q. Lin, B. Qiao, H. Zhang, Y . Dang, C. Xie, X. Yang, Q. Cheng, Z. Li et al., “Robust log-based anomaly detection on unstable log data,” in Proceedings of the 2019 27th ACM joint meeting on European software engineering conference and symposium on the foundat...

    2019

  31. [39]

    Self- attentive classification-based anomaly detection in unstructured logs,

    S. Nedelkoski, J. Bogatinovski, A. Acker, J. Cardoso, and O. Kao, “Self- attentive classification-based anomaly detection in unstructured logs,” in IEEE TRANSACTIONS ON SOFTW ARE ENGINEERING 13 2020 IEEE International Conference on Data Mining (ICDM) . IEEE, 2020, pp. 1196–1201

    2020

  32. [40]

    Multi-scale one-class recurrent neural networks for discrete event sequence anomaly detection,

    Z. Wang, Z. Chen, J. Ni, H. Liu, H. Chen, and J. Tang, “Multi-scale one-class recurrent neural networks for discrete event sequence anomaly detection,” in Proceedings of the 27th ACM SIGKDD conference on knowledge discovery & data mining , 2021, pp. 3726–3734

    2021

  33. [41]

    Cat: beyond efficient transformer for content-aware anomaly detection in event sequences,

    S. Zhang, Y . Liu, X. Zhang, W. Cheng, H. Chen, and H. Xiong, “Cat: beyond efficient transformer for content-aware anomaly detection in event sequences,” in Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , 2022, pp. 4541–4550

    2022

  34. [42]

    An approach for anomaly diagnosis based on hybrid graph model with logs for distributed services,

    T. Jia, P. Chen, L. Yang, Y . Li, F. Meng, and J. Xu, “An approach for anomaly diagnosis based on hybrid graph model with logs for distributed services,” in 2017 IEEE international conference on web services (ICWS). IEEE, 2017, pp. 25–32

    2017

  35. [43]

    Aclog: An approach to detecting anomalies from system logs with active learning,

    C. Duan, T. Jia, Y . Li, and G. Huang, “Aclog: An approach to detecting anomalies from system logs with active learning,” in 2023 IEEE International Conference on Web Services (ICWS) . IEEE, 2023, pp. 436–443

    2023

  36. [44]

    Improving log-based anomaly detection with component-aware analysis,

    K. Yin, M. Yan, L. Xu, Z. Xu, Z. Li, D. Yang, and X. Zhang, “Improving log-based anomaly detection with component-aware analysis,” in 2020 IEEE International Conference on Software Maintenance and Evolution (ICSME). IEEE, 2020, pp. 667–671

    2020

  37. [45]

    Maddc: Multi-scale anomaly detection, diagnosis and correction for discrete event logs,

    X. Wang, L. Yang, D. Li, L. Ma, Y . He, J. Xiao, J. Liu, and Y . Yang, “Maddc: Multi-scale anomaly detection, diagnosis and correction for discrete event logs,” in Proceedings of the 38th Annual Computer Security Applications Conference , 2022, pp. 769–784

    2022

  38. [46]

    Log sequence anomaly detection based on local information extraction and globally sparse transformer model,

    C. Zhang, X. Wang, H. Zhang, H. Zhang, and P. Han, “Log sequence anomaly detection based on local information extraction and globally sparse transformer model,” IEEE Transactions on Network and Service Management, vol. 18, no. 4, pp. 4119–4133, 2021

    2021

  39. [47]

    Logclass: Anomalous log iden- tification and classification with partial labels,

    W. Meng, Y . Liu, S. Zhang, F. Zaiter, Y . Zhang, Y . Huang, Z. Yu, Y . Zhang, L. Song, M. Zhang et al. , “Logclass: Anomalous log iden- tification and classification with partial labels,” IEEE Transactions on Network and Service Management, vol. 18, no. 2, pp. 1870–1884, 2021

    2021

  40. [48]

    Try with simpler–an evaluation of improved principal component anal- ysis in log-based anomaly detection,

    L. Yang, J. Chen, S. Gao, Z. Gong, H. Zhang, Y . Kang, and H. Li, “Try with simpler–an evaluation of improved principal component anal- ysis in log-based anomaly detection,” ACM Transactions on Software Engineering and Methodology , 2023

    2023

  41. [49]

    Unsupervised log message anomaly detection,

    A. Farzad and T. A. Gulliver, “Unsupervised log message anomaly detection,” ICT Express, vol. 6, no. 3, pp. 229–237, 2020

    2020

  42. [50]

    Automatic abnormal log detection by analyzing log history for providing debugging insight,

    J. Kim, V . Savchenko, K. Shin, K. Sorokin, H. Jeon, G. Pankratenko, S. Markov, and C.-J. Kim, “Automatic abnormal log detection by analyzing log history for providing debugging insight,” inProceedings of the ACM/IEEE 42nd International Conference on Software Engineering: Soft...

    2020

  43. [51]

    Detecting large-scale system problems by mining console logs,

    W. Xu, L. Huang, A. Fox, D. Patterson, and M. I. Jordan, “Detecting large-scale system problems by mining console logs,” in Proceedings of the ACM SIGOPS 22nd Symposium on Operating Systems Principles (SOSP), 2009, pp. 117–132

    2009

  44. [52]

    What supercomputers say: A study of five system logs,

    A. Oliner and J. Stearley, “What supercomputers say: A study of five system logs,” in 37th annual IEEE/IFIP international conference on dependable systems and networks (DSN’07) . IEEE, 2007, pp. 575– 584

    2007

  45. [53]

    Software testing with large language models: Survey, landscape, and vision,

    J. Wang, Y . Huang, C. Chen, Z. Liu, S. Wang, and Q. Wang, “Software testing with large language models: Survey, landscape, and vision,”IEEE Transactions on Software Engineering , 2024

    2024

  46. [54]

    Evaluating large language models in class-level code generation,

    X. Du, M. Liu, K. Wang, H. Wang, J. Liu, Y . Chen, J. Feng, C. Sha, X. Peng, and Y . Lou, “Evaluating large language models in class-level code generation,” in Proceedings of the IEEE/ACM 46th International Conference on Software Engineering , 2024, pp. 1–13

    2024

  47. [55]

    Large language models for software engineering: Survey and open problems,

    A. Fan, B. Gokkaya, M. Harman, M. Lyubarskiy, S. Sengupta, S. Yoo, and J. M. Zhang, “Large language models for software engineering: Survey and open problems,” arXiv preprint arXiv:2310.03533 , 2023

    2023 arXiv

  48. [56]

    Practitioners’ expectations on code completion,

    C. Wang, J. Hu, C. Gao, Y . Jin, T. Xie, H. Huang, Z. Lei, and Y . Deng, “Practitioners’ expectations on code completion,” arXiv preprint arXiv:2301.03846, 2023

    2023 arXiv

  49. [57]

    A language model for statements of software code,

    Y . Yang, Y . Jiang, M. Gu, J. Sun, J. Gao, and H. Liu, “A language model for statements of software code,” in 2017 32nd IEEE/ACM International Conference on Automated Software Engineering (ASE) . IEEE, 2017, pp. 682–687

    2017

  50. [58]

    Failure prediction in ibm bluegene/l event logs,

    Y . Liang, Y . Zhang, H. Xiong, and R. Sahoo, “Failure prediction in ibm bluegene/l event logs,” in 7th IEEE International Conference on Data Mining (ICDM). IEEE, 2007, pp. 583–588

    2007

  51. [59]

    Automated it system failure prediction: A deep learning approach,

    K. Zhang, J. Xu, M. R. Min, G. Jiang, K. Pelechrinis, and H. Zhang, “Automated it system failure prediction: A deep learning approach,” in 2016 IEEE International Conference on Big Data (Big Data) . IEEE, 2016, pp. 1291–1300

    2016

  52. [60]

    Long short-term memory based operation log anomaly detection,

    R. Vinayakumar, K. Soman, and P. Poornachandran, “Long short-term memory based operation log anomaly detection,” in 2017 International Conference on Advances in Computing, Communications and Informat- ics (ICACCI). IEEE, 2017, pp. 236–242

    2017

  53. [61]

    Detecting anomaly in big data system logs using convolutional neural network,

    S. Lu, X. Wei, Y . Li, and L. Wang, “Detecting anomaly in big data system logs using convolutional neural network,” in 2018 IEEE 16th Intl Conf on Dependable, Autonomic and Secure Computing, 16th Intl Conf on Pervasive Intelligence and Computing, 4th Intl Conf on Big Data Inte...

    2018

  54. [62]

    Log clustering based problem identification for online service systems,

    Q. Lin, H. Zhang, J.-G. Lou, Y . Zhang, and X. Chen, “Log clustering based problem identification for online service systems,” in Proceedings of the 38th International Conference on Software Engineering Compan- ion, 2016, pp. 102–111

    2016

  55. [63]

    Lanobert: System log anomaly detection based on bert masked language model,

    Y . Lee, J. Kim, and P. Kang, “Lanobert: System log anomaly detection based on bert masked language model,” Applied Soft Computing , vol. 146, p. 110689, 2023

    2023

  56. [64]

    Are they all good? studying practitioners’ expectations on the readability of log messages,

    Z. Li, A. R. Chen, X. Hu, X. Xia, T.-H. Chen, and W. Shang, “Are they all good? studying practitioners’ expectations on the readability of log messages,” in 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE) . IEEE, 2023, pp. 129–140

    2023

  57. [65]

    An interview study about the use of logs in embedded software engineering,

    N. Yang, P. Cuijpers, D. Hendriks, R. Schiffelers, J. Lukkien, and A. Serebrenik, “An interview study about the use of logs in embedded software engineering,” Empirical Software Engineering , vol. 28, no. 2, p. 43, 2023

    2023

  58. [66]

    How do developers’ profiles and experiences influence their logging practices? an empirical study of industrial practitioners,

    G. Rong, S. Gu, H. Shen, H. Zhang, and H. Kuang, “How do developers’ profiles and experiences influence their logging practices? an empirical study of industrial practitioners,” in 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE). IEEE, 2023, pp. 855–867

    2023

  59. [67]

    A survey on automated log analysis for reliability engineering,

    S. He, P. He, Z. Chen, T. Yang, Y . Su, and M. R. Lyu, “A survey on automated log analysis for reliability engineering,” ACM computing surveys (CSUR), vol. 54, no. 6, pp. 1–37, 2021

    2021

  60. [68]

    Where do developers log? an empirical study on logging practices in industry,

    Q. Fu, J. Zhu, W. Hu, J.-G. Lou, R. Ding, Q. Lin, D. Zhang, and T. Xie, “Where do developers log? an empirical study on logging practices in industry,” in Companion Proceedings of the 36th International Confer- ence on Software Engineering , 2014, pp. 24–33

    2014

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.