Behavioral Anomaly Detection in Distributed Systems via Federated Contrastive Learning

Heyi Wang; Lian Lian; Qiyuan Wu; Renhan Zhang; Renzi Meng; Yumeng Sun

REVIEW 5 major objections 3 minor 2 cited by

Behavioral Anomaly Detection in Distributed Systems via Federated Contrastive Learning

T0 review · 5 major / 3 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that federated contrastive learning detects behavioral anomalies in distributed systems without exposing raw data, outperforming FedCAC, MOON, and FedProto on the SWaT benchmark.

desk verdict Plausible incremental idea, but Table 1 is unverifiable as reported and the method section is too vague to know what was actually run. read the letter →

arxiv 2506.19246 v1 pith:RCIRLJIH submitted 2025-06-24 cs.LG

Renzi Meng , Heyi Wang , Yumeng Sun , Qiyuan Wu , Lian Lian , Renhan Zhang This is my paper · ORCID

classification cs.LG

keywords federatedlearningcontrastiveanomalydetectiondistributedsystemsSWaTdatasetprivacy-preservingmachineNT-Xentlossindustrialcontrol

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes a method that combines federated learning with contrastive learning to detect behavioral anomalies in distributed systems while keeping raw data local. Each node learns embedding representations from logs, metrics, and system calls, then contributes to a global model through federated aggregation. On the SWaT industrial control dataset, the paper reports an F1-score of 91.5%, precision of 90.2%, and AUC of 94.7%, beating three federated baselines. If these results hold, the method offers a privacy-preserving path to accurate, real-time anomaly detection in distributed environments.

What carries the argument

The carrying mechanism is the combination of a local encoder $f_\theta$ that maps behavior data to embeddings, the NT-Xent contrastive loss that pulls same-category samples together and pushes different-category samples apart, a classification loss for predictive accuracy, and a local regularization term that keeps each node's model close to its own features while contributing to a shared model. Federated weighted averaging, $\theta_{\text{global}} = \sum_i \frac{|D_i|}{\sum_j |D_j|} \theta_i$, produces a global model without transmitting raw data. The contrastive loss is what the paper credits for learning the fine-grained distinctions that standard federated averaging obscures.

What would settle it

Try to reproduce Table 1 by running the proposed method on SWaT with a fully documented client partition, fixed hyperparameters, and the same tuning budget for FedCAC, MOON, and FedProto; if the 91.5% F1 and the 3.4-point margin over MOON cannot be obtained, the central claim loses its experimental foundation.

Watch

Extended reading notes

Core claim

The paper's central claim is that a federated model trained with a contrastive objective can outperform standard federated learning baselines for anomaly detection in distributed systems. Each node encodes behavior data into embeddings, forms positive and negative sample pairs from the same or different behavioral categories, and trains with NT-Xent contrastive loss, a classification loss, and a local regularization term. Parameters are aggregated by weighted averaging into a global model without raw data leaving the nodes. On SWaT, the method achieves an F1-score of 91.5%, precision of 90.2%, and AUC of 94.7%, and its accuracy rises from about 0.87 to 0.95 in a simulated real-time stream. The paper attributes these gains to contrastive separation in the embedding space and to preserving local sensitivity through regularization.

Load-bearing premise

That the comparison against FedCAC, MOON, and FedProto is fair, which requires the SWaT data partition, hyperparameters, and baseline tuning to be representative; the paper does not report this setup.

Editorial extensions

If this is right

A global anomaly detector can be trained across nodes that never share raw behavioral data, so privacy and compliance constraints do not force centralized collection.
The reported precision of 90.2% implies fewer false alarms than the three baselines, which matters because false alarms consume diagnostic resources in distributed systems.
The attack-type breakdown shows command injection detected near 0.94 accuracy, replay and data injection between 0.88 and 0.90, and DoS and timing attacks below 0.88, indicating where future effort is needed.
In the simulated real-time stream, accuracy rises from about 0.87 to 0.95, suggesting the same architecture can serve online monitoring rather than batch analysis.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper leaves the federated partitioning of SWaT unspecified; a natural stress test is to vary the partition from random to physically grouped clients, and the method's stated advantage should persist if the contrastive mechanism is truly responsible.
If the same contrastive objective were applied without labels, using temporal neighbors as positive pairs and random samples as negatives, it could extend to settings where anomaly labels are scarce, a direction the paper does not explore.
The per-attack results suggest temporal contrastive learning or cross-node context fusion as a specific next step to lift DoS and timing detection above 0.88, which the paper mentions only as future work.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Best to know up front: this is a standard federated-contrastive combination (MOON already pairs FedAvg with a contrastive loss) applied to SWaT, and the only evidence it works is Table 1, which lacks the experimental protocol needed to check anything. The authors may well have a working method, but this manuscript doesn't let a reader confirm it.

What is genuinely new is narrow: adding a cross-entropy term and a local regularization penalty to the contrastive loss in a federated setting, and reporting F1/precision/AUC on SWaT. That is a reasonable configuration to try. The paper also does a sensible thing by testing on a standard ICS benchmark rather than a toy dataset, and the per-attack-type analysis and simulated stream experiment show awareness of what real deployments care about.

The soft spots are substantial. The comparison table lists three federated baselines but never says how SWaT was partitioned into clients, how windows were built, how the train/test split was done, how many communication rounds, local epochs, batch size, optimizer, or how the baselines were tuned. Without that, the 3–5 point F1 advantage is exactly the size of artifact that partition choice or under-tuned baselines can produce. The loss equations are also corrupted: the NT-Xent sum has no indices, and the FedAvg weighting formula is ambiguous. The citation pattern is odd—several references are about microservice scheduling or traffic scheduling and are used as narrative support rather than technical foundation, and one of them (ref [16]) includes an author of this paper, which is not itself a problem but doesn't add credibility here.

On the positive side, the central idea is coherent and the authors don't overclaim beyond the table. The problem is purely evidentiary: the paper gives no way to reproduce the numbers. This is a desk-reject level of reporting, not something I'd send to referees as-is. If the authors provided code, the full experimental setup, and error bars, the incremental idea might be worth a proper review. As it stands, I would not cite it and would not bring it to reading group. For peer review: reject; if a revised version with complete experimental details appears, reconsider.

Referee Report

5 major / 3 minor

Summary. This paper proposes a method for anomaly detection in distributed systems that combines federated learning and contrastive learning. Each client encodes local behavior data into embeddings, trains with an NT-Xent contrastive loss and a classification loss, and shares model parameters with a central server for weighted aggregation. The paper evaluates the method on the SWaT dataset, reporting an F1-score of 91.5%, precision of 90.2%, and AUC of 94.7%, which it claims outperforms FedCAC, MOON, and FedProto. It also presents per-attack-type detection accuracy and a simulated real-time data stream responsiveness experiment.

Significance. If the reported results were reproducible, the work could be of practical interest for privacy-preserving anomaly detection in industrial systems, since it combines two established techniques in a straightforward manner. However, the paper provides no verifiable artifacts: there are no machine-checked proofs, no released code, and the experimental protocol is almost entirely unspecified. The central contribution is therefore not assessable from the manuscript as it stands, and the claimed improvements over baselines cannot be confirmed.

major comments (5)

[Section III.B, Table 1] The central claim of a 3.4–5.1 point F1 advantage over FedCAC, MOON, and FedProto is unverifiable because the experimental protocol is not described. The manuscript does not state the number of clients, how the SWaT data are partitioned into local nodes, the sliding-window length or stride, the train/test split, the evaluation granularity (per-timestamp vs. per-window), the hyperparameters (lambda_1, lambda_2, tau, learning rate, optimizer, batch size, local epochs, communication rounds), or the tuning budget for the baselines. Without this information, the reported differences could be artefacts of the experimental setup rather than of the proposed method.
[Section II, Eqs. (2)–(4)] The mathematical formulation is too corrupted to specify the method. Eq. (2) for the NT-Xent loss omits the summation indices and does not define the set Z; Eq. (3) for federated aggregation is garbled, with an unclear denominator and an ambiguous role for N, and the 'weighted average' description does not match a correct FedAvg update; Eq. (4) for the total loss is unreadable because of corrupted symbols. A reader cannot implement or verify the proposed method from these equations.
[Section III.A] The paper claims the SWaT dataset is well-suited for simulating local nodes but never specifies the actual partitioning. SWaT is a single continuous time series from a six-stage plant; the number of clients, whether partitioning is by stage, sensor group, or time range, and how heterogeneous the client distributions are, are all absent. These choices define the federated problem and materially affect the comparison.
[Section III.B (Figures 2 and 3)] The two additional experimental claims—per-attack accuracy and responsiveness in a simulated real-time data stream—are not supported by any provided evidence. The corresponding figures are placeholders, and the text gives only qualitative trends with approximate values (e.g., 'nearly 0.94', 'between 0.88 and 0.90'). No details are given on how the data stream is simulated, how online updates are performed, which attacks are included, or how these results are measured.
[Section III.B, Table 1] No statistical support is provided for the results: the table reports single-point metrics with no standard deviations, no number of independent runs, and no significance tests. Given that the gap between methods is only 3–5 points in F1, the absence of error bars leaves open the possibility that the reported improvements are within run-to-run noise.

minor comments (3)

[General] The manuscript references Figures 1, 2, and 3, but the figures are not present in the submitted text; the reader sees only placeholders.
[References] References [13]–[20] are largely topically tangential to the claims they support (e.g., microservice scheduling, traffic scheduling, cloud memory forecasting) and do not provide meaningful methodological grounding for the contrastive loss or regularization terms.
[Section II] Several equations and notations contain corruption, for example the dataset definition is rendered as '},...,,{ )()2()1( n iiii xxxD ='; these should be corrected for readability.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the method's claims are empirical, benchmark-based, and do not reduce to fitted inputs or self-cited results.

full rationale

The paper makes no derivational claim that could reduce to its own inputs. Its central contribution is an empirical evaluation (Section III.B, Table 1) of a federated contrastive learning model on the SWaT dataset, compared with external baselines FedCAC, MOON, and FedProto. No parameter is fitted to the target metric and then renamed as a prediction; the reported F1, Precision, and AUC values are experimental outcomes, not consequences of the method's equations. The method combines standard components: NT-Xent contrastive loss, cross-entropy classification loss, FedAvg-style aggregation, and a local regularization term. The NT-Xent equation is stated directly as a definition rather than derived from any prior result, so there is no self-definitional circularity. The only self-citation is reference [16] (Zhu, Wu, Tang, Meng, Chai, Quan), cited for the general idea that relational consistency aids generalization when justifying the contrastive loss choice; this citation is motivational and not load-bearing, and the loss itself is a standard formulation. No uniqueness theorem is invoked, and the empirical comparison does not depend on any self-cited result. The absence of experimental details such as data partitioning, hyperparameters, and baseline tuning is a reproducibility and correctness concern, not a circularity concern. Therefore, no circular step is identified.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The method relies on standard machinery (encoder, NT-Xent, cross-entropy, federated averaging) but leaves all critical hyperparameters and partitioning details unspecified, so the central empirical claim rests on unstated experimental choices.

free parameters (3)

contrastive loss weight lambda_1
Used in L_total = lambda_1 * L_contrast + lambda_2 * L_class + ||theta_i - theta_global||^2; no value is reported.
classification loss weight lambda_2
Same total-loss equation; no value is reported.
temperature tau in NT-Xent loss
Controls the sharpness of the contrastive loss; no value is reported.

assumptions (4)

domain assumption SWaT data can be partitioned into independent federated nodes that reflect real distributed system behavior
Section III.A says the SWaT components operate relatively independently and are used to simulate local nodes, but the actual partitioning scheme is not described.
domain assumption NT-Xent loss with positive/negative pairs from same/different classes produces useful embeddings for anomaly detection
Section II states this without proof or reference to established anomaly detection contrastive learning.
domain assumption Federated averaging converges to a global model that captures both common and local anomaly patterns
Section II assumes the weighted average update provides the claimed generalization, with no analysis of convergence under the heterogeneity of SWaT.
ad hoc to paper The experimental protocol yields representative metrics from a single run
No multiple runs, error bars, or statistical tests are reported; the paper treats single numbers as definitive.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Behavioral Anomaly Detection in Distributed Systems via Federated Contrastive Learning." pith.science (2026). https://pith.science/paper/RCIRLJIH

@misc{pith2026250619246,
  author       = {Pith},
  title        = {Pith review of: Behavioral Anomaly Detection in Distributed Systems via Federated Contrastive Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RCIRLJIH}},
  note         = {Machine review of arXiv:2506.19246}
}

read the original abstract

This paper addresses the increasingly prominent problem of anomaly detection in distributed systems. It proposes a detection method based on federated contrastive learning. The goal is to overcome the limitations of traditional centralized approaches in terms of data privacy, node heterogeneity, and anomaly pattern recognition. The proposed method combines the distributed collaborative modeling capabilities of federated learning with the feature discrimination enhancement of contrastive learning. It builds embedding representations on local nodes and constructs positive and negative sample pairs to guide the model in learning a more discriminative feature space. Without exposing raw data, the method optimizes a global model through a federated aggregation strategy. Specifically, the method uses an encoder to represent local behavior data in high-dimensional space. This includes system logs, operational metrics, and system calls. The model is trained using both contrastive loss and classification loss to improve its ability to detect fine-grained anomaly patterns. The method is evaluated under multiple typical attack types. It is also tested in a simulated real-time data stream scenario to examine its responsiveness. Experimental results show that the proposed method outperforms existing approaches across multiple performance metrics. It demonstrates strong detection accuracy and adaptability, effectively addressing complex anomalies in distributed environments. Through careful design of key modules and optimization of the training mechanism, the proposed method achieves a balance between privacy preservation and detection performance. It offers a feasible technical path for intelligent security management in distributed systems.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Topology-Aware Graph Reinforcement Learning for Dynamic Routing in Cloud Networks
cs.LG 2025-09 reject novelty 3.0 of 10

A graph RL router with structure-aware state encoding and policy-driven edge rewiring reports improved throughput and latency on GEANT, based on single-run table comparisons.
Graph Neural Network and Transformer Integration for Unsupervised System Anomaly Discovery
cs.LG 2025-08 reject novelty 3.0 of 10

GTF-Net, a GCN-Transformer fusion, reports F1 0.889 and AUC 0.942 for anomaly detection on Alibaba cluster data, but omits the training objective and code.

Reference graph

Works this paper leans on

23 extracted references · 17 canonical work pages · cited by 2 Pith papers

[16]

Graph Neural Network-Based Collaborative Perception for Adaptive Scheduling in Distributed Systems,

W. Zhu, Q. Wu, T. Tang, R. Meng, S. Chai, and X. Quan, “Graph Neural Network-Based Collaborative Perception for Adaptive Scheduling in Distributed Systems,” arXiv preprint arXiv:2505.16248, 2025

arXiv 2025
[1]

A survey of graph-based deep learning for anomaly detection in distributed systems,

A. D. Pazho, G. A. Noghre, A. A. Purkayastha, et al., "A survey of graph-based deep learning for anomaly detection in distributed systems," IEEE Trans. Knowl. Data Eng., vol. 36, no. 1, pp. 1-20, 2023

work page 2023
[2]

A Reinforcement Learning Approach to Traffic Scheduling in Complex Data Center Topologies,

Y. Deng, “A Reinforcement Learning Approach to Traffic Scheduling in Complex Data Center Topologies,” Journal of Computer Technology and Software, vol. 4, no. 3, 2025

work page 2025
[3]

Distributed anomaly detection in smart grids: a federated learning-based approach,

J. Jithish, B. Alangot, N. Mahalingam, et al., "Distributed anomaly detection in smart grids: a federated learning-based approach," IEEE Access, vol. 11, pp. 7157-7179, 2023

work page 2023
[4]

DAD: A Distributed Anomaly Detection system using ensemble one-class statistical learning in edge networks,

N. Moustafa, M. Keshk, K. K. R. Choo, et al., "DAD: A Distributed Anomaly Detection system using ensemble one-class statistical learning in edge networks," Future Gener. Comput. Syst., vol. 118, pp. 240-251, 2021

work page 2021
[5]

Host-based IDS: A review and open issues of an anomaly detection system in IoT,

I. Martins, J. S. Resende, P. R. Sousa, et al., "Host-based IDS: A review and open issues of an anomaly detection system in IoT," Future Gener. Comput. Syst., vol. 133, pp. 95-113, 2022

work page 2022
[6]

Experience report: Deep learning-based system log analysis for anomaly detection,

Z. Chen, J. Liu, W. Gu, et al., "Experience report: Deep learning-based system log analysis for anomaly detection," arXiv preprint arXiv:2107.05908, 2021

arXiv 2021
[7]

Self-Attention-Based Modeling of Multi-Source Metrics for Performance Trend Prediction in Cloud Systems,

H. Xin and R. Pan, “Self-Attention-Based Modeling of Multi-Source Metrics for Performance Trend Prediction in Cloud Systems,” Journal of Computer Technology and Software, vol. 4, no. 4, 2025

2025

Show all 23 references

[8]

A comprehensive study of anomaly detection schemes in IoT networks using machine learning algorithms,

A. Diro, N. Chilamkurti, V. D. Nguyen, et al., "A comprehensive study of anomaly detection schemes in IoT networks using machine learning algorithms," Sensors, vol. 21, no. 24, p. 8320, 2021

2021
[9]

Self- Supervised Graph Neural Networks for Enhanced Feature Extraction in Heterogeneous Information Networks

J. Wei, Y. Liu, X. Huang, X. Zhang, W. Liu and X. Yan, "Self- Supervised Graph Neural Networks for Enhanced Feature Extraction in Heterogeneous Information Networks", 2024 5th International Conference on Machine Learning and Computer Application (ICMLCA), pp. 272-276, 2024

2024
[10]

Distributed anomaly detection using concept drift detection based hybrid ensemble techniques in streamed network data,

M. Jain and G. Kaur, "Distributed anomaly detection using concept drift detection based hybrid ensemble techniques in streamed network data," Cluster Comput., vol. 24, no. 3, pp. 2099-2114, 2021

2021
[11]

Security and privacy-enhanced federated learning for anomaly detection in IoT infrastructures,

L. Cui, Y. Qu, G. Xie, et al., "Security and privacy-enhanced federated learning for anomaly detection in IoT infrastructures," IEEE Trans. Ind. Informat., vol. 18, no. 5, pp. 3492-3500, 2021

2021
[12]

Light-weight federated learning-based anomaly detection for time-series data in industrial control systems,

H. T. Truong, B. P. Ta, Q. A. Le, et al., "Light-weight federated learning-based anomaly detection for time-series data in industrial control systems," Comput. Ind., vol. 140, p. 103692, 2022

2022
[13]

Topology-aware decision making in distributed scheduling via multi-agent reinforcement learning,

B. Wang, “Topology-aware decision making in distributed scheduling via multi-agent reinforcement learning,” Transactions on Computational and Scientific Methods, vol. 5, no. 4, 2025

2025
[14]

Continuous Control-Based Load Balancing for Distributed Systems Using TD3 Reinforcement Learning,

Y. Duan, “Continuous Control-Based Load Balancing for Distributed Systems Using TD3 Reinforcement Learning,” Journal of Computer Technology and Software, vol. 3, no. 6, 2024

2024
[15]

Intelligent Task Scheduling for Microservices via A3C-Based Reinforcement Learning,

Y. Wang, T. Tang, Z. Fang, Y. Deng, and Y. Duan, “Intelligent Task Scheduling for Microservices via A3C-Based Reinforcement Learning,” arXiv preprint arXiv:2505.00299, 2025

2025 arXiv
[17]

Distributed network traffic scheduling via trust-constrained policy learning mechanisms,

Y. Ren, M. Wei, H. Xin, T. Yang, and Y. Qi, “Distributed network traffic scheduling via trust-constrained policy learning mechanisms,” Transactions on Computational and Scientific Methods, vol. 5, no. 4, 2025

2025
[18]

Transforming Multidimensional Time Series into Interpretable Event Sequences for Advanced Data Mining,

X. Yan, Y. Jiang, W. Liu, D. Yi and J. Wei, "Transforming Multidimensional Time Series into Interpretable Event Sequences for Advanced Data Mining," 2024 5th International Conference on Intelligent Computing and Human-Computer Interaction (ICHCI), pp. 126-130, 2024

2024
[19]

Temporal-Spatial Deep Learning for Memory Usage Forecasting in Cloud Servers

K. Aidi and D. Gao, “Temporal-Spatial Deep Learning for Memory Usage Forecasting in Cloud Servers”, 2025

2025
[20]

Multivariate Time Series Forecasting Through Automated Feature Extraction and Transformer-Based Modeling,

Y. Cheng, “Multivariate Time Series Forecasting Through Automated Feature Extraction and Transformer-Based Modeling,” Journal of Computer Science and Software Applications, vol. 5, no. 5, 2025

2025
[21]

Bold but cautious: Unlocking the potential of personalized federated learning through cautiously aggressive collaboration,

X. Wu, X. Liu, J. Niu, et al., "Bold but cautious: Unlocking the potential of personalized federated learning through cautiously aggressive collaboration," Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 19375-19384, 2023

2023
[22]

Model-contrastive federated learning,

Q. Li, B. He and D. Song, "Model-contrastive federated learning," Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 10713-10722, 2021

2021
[23]

Fedproto: Federated prototype learning across heterogeneous clients,

Y. Tan, G. Long, L. Liu, et al., "Fedproto: Federated prototype learning across heterogeneous clients," Proceedings of the AAAI Conference on Artificial Intelligence, vol. 36, no. 8, pp. 8432-8440, 2022

2022

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [16]

Graph Neural Network-Based Collaborative Perception for Adaptive Scheduling in Distributed Systems,

W. Zhu, Q. Wu, T. Tang, R. Meng, S. Chai, and X. Quan, “Graph Neural Network-Based Collaborative Perception for Adaptive Scheduling in Distributed Systems,” arXiv preprint arXiv:2505.16248, 2025

arXiv 2025

[2] [1]

A survey of graph-based deep learning for anomaly detection in distributed systems,

A. D. Pazho, G. A. Noghre, A. A. Purkayastha, et al., "A survey of graph-based deep learning for anomaly detection in distributed systems," IEEE Trans. Knowl. Data Eng., vol. 36, no. 1, pp. 1-20, 2023

work page 2023

[3] [2]

A Reinforcement Learning Approach to Traffic Scheduling in Complex Data Center Topologies,

Y. Deng, “A Reinforcement Learning Approach to Traffic Scheduling in Complex Data Center Topologies,” Journal of Computer Technology and Software, vol. 4, no. 3, 2025

work page 2025

[4] [3]

Distributed anomaly detection in smart grids: a federated learning-based approach,

J. Jithish, B. Alangot, N. Mahalingam, et al., "Distributed anomaly detection in smart grids: a federated learning-based approach," IEEE Access, vol. 11, pp. 7157-7179, 2023

work page 2023

[5] [4]

DAD: A Distributed Anomaly Detection system using ensemble one-class statistical learning in edge networks,

N. Moustafa, M. Keshk, K. K. R. Choo, et al., "DAD: A Distributed Anomaly Detection system using ensemble one-class statistical learning in edge networks," Future Gener. Comput. Syst., vol. 118, pp. 240-251, 2021

work page 2021

[6] [5]

Host-based IDS: A review and open issues of an anomaly detection system in IoT,

I. Martins, J. S. Resende, P. R. Sousa, et al., "Host-based IDS: A review and open issues of an anomaly detection system in IoT," Future Gener. Comput. Syst., vol. 133, pp. 95-113, 2022

work page 2022

[7] [6]

Experience report: Deep learning-based system log analysis for anomaly detection,

Z. Chen, J. Liu, W. Gu, et al., "Experience report: Deep learning-based system log analysis for anomaly detection," arXiv preprint arXiv:2107.05908, 2021

arXiv 2021

[8] [7]

Self-Attention-Based Modeling of Multi-Source Metrics for Performance Trend Prediction in Cloud Systems,

H. Xin and R. Pan, “Self-Attention-Based Modeling of Multi-Source Metrics for Performance Trend Prediction in Cloud Systems,” Journal of Computer Technology and Software, vol. 4, no. 4, 2025

2025