Pith. sign in

REVIEW 4 major objections 9 minor 25 references

TPLogAD: Unsupervised Log Anomaly Detection Based on Event Templates and Key Parameters

T0 review · 4 major / 9 minor · reviewed 2026-08-12 · deepseek-v4-flash

Pith's one-line read Pairing event templates with parameter vectors gives unsupervised log anomaly detection F1 scores of 0.95–0.97 across four public datasets.

desk verdict A clean template-side idea wrapped around an under-specified parameter branch; the ablation credits a component that is never clearly connected to the decision rule. read the letter →

arxiv 2411.15250 v1 pith:SCYEYPCB submitted 2024-11-22 cs.LG cs.AIcs.CLcs.CY

classification cs.LGcs.AIcs.CLcs.CY
keywords loganomalydetectioneventtemplatesparameterembeddingunsupervisedlearningsemanticrepresentationBiLSTMBERTpara2vec
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that log anomaly detection improves when each log entry is represented by both its event template and the values of its key parameters, rather than by the template alone. It introduces TPLogAD, an unsupervised method with two representation components: itemplate2vec builds semantic template vectors from BERT word embeddings, and para2vec encodes five common parameter types. On the BGL, HDFS, ThunderBird, and Spirit datasets, the authors report F1 scores between 0.95 and 0.97, above the 0.60 to 0.92 range of the compared baselines. They also report that the method remains useful when only 40% of the data is used for training, with F1 staying above 0.80. If these results hold, log analysis systems could stop discarding parameter content and detect both sequence and parameter anomalies in one pass.

What carries the argument

Two named representation methods carry the argument. itemplate2vec converts the fixed text of an event template into a vector by fine-tuning BERT on historical logs, computing each word's weight as its average cosine similarity to the other words in the template, and averaging the weighted word vectors. para2vec encodes key parameters: Kmeans clustering selects the main parameters, then time parameters are mapped onto a unit circle, user IDs are hashed to 64-bit numbers, numeric values are z-score normalized, state values are one-hot encoded and collapsed to numbers, and resource IDs are embedded via TF-IDF. These two vector streams are concatenated and fed to a BiLSTM with attention, whose learned normal behavior is the reference against which online logs are judged.

What would settle it

Run TPLogAD on a fifth log dataset with a different parameter vocabulary (for example, container orchestrator logs with image names, request IDs, and status codes) while keeping the qualitative rules and thresholds unchanged; if F1 falls to the level of the template-only ablation or below 0.80, the claimed generalizability of para2vec's parameter criteria is undercut.

Watch

Extended reading notes

Core claim

The central claim is that jointly modeling event templates and parameters is both feasible and superior to template-only or time-parameter-only approaches. TPLogAD parses logs with Drain3, builds template vectors via itemplate2vec by weighting BERT word vectors by their average cosine similarity to other words in the template, and builds parameter vectors via para2vec, which clusters parameters with Kmeans, identifies the most representative ones, and encodes time, user identification, numerical, state, and resource identification parameters with distinct type-specific transforms. A BiLSTM with attention learns normal patterns from the combined vectors, and online logs are flagged as anomalous when their template sequence or parameter sequence deviates from what the model learned. The paper additionally claims that the online update mechanism adapts to newly appearing templates without manual feedback.

Load-bearing premise

The method relies on hand-written qualitative rules for deciding when a parameter value is anomalous, and these rules assume that unspecified thresholds like a 'reasonable range' generalize across log systems without being tuned to the four tested datasets.

Editorial extensions

If this is right

  • Log analysis tools can treat parameter content as signal rather than noise, which should reduce false alarms in systems that generate millions of logs per day.
  • Newly appearing log templates can be handled by matching to the most similar stored template vector, so the detector can adapt to software updates without retraining or administrator feedback.
  • Combining template and parameter evidence should catch anomalies that are invisible in either stream alone, such as a normal event type carrying an out-of-range parameter.
  • The method's robustness under 60%, 50%, and 40% training splits suggests it can be deployed before large amounts of labeled data are collected.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The qualitative anomaly rules for the five parameter types (e.g., 'reasonable range' and 'too frequently') omit concrete thresholds; a natural test is whether a threshold-free or statistically learned version of these rules can match the reported F1.
  • Because the method is unsupervised and parameter-type-based, it may transfer to log domains beyond supercomputers and HDFS, such as cloud-native microservice logs, provided the five parameter types still cover the log vocabulary.
  • The separation of template semantics from parameter values suggests a reusable design principle for other log-analysis tasks, such as root-cause diagnosis or alert correlation, not just anomaly detection.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 9 minor

Summary. This paper proposes TPLogAD, an unsupervised log anomaly detection framework for unstructured logs built on Drain3-parsed event templates and parameters. The template branch (itemplate2vec) encodes template words with a fine-tuned BERT, reweights words by their average cosine similarity to other words in the template (Eqs. 1-2), and forms each template vector as a weighted average; a BiLSTM with attention then predicts the next template within a window of width w=20. The parameter branch (para2vec) selects 'key parameters' via KMeans and encodes five parameter types: cyclic time encodings (Eq. 3), 64-bit hashed user identifiers (Eq. 4), z-scored numerical values, one-hot-to-integer states (Eq. 5), and TF-IDF resource identifiers; parameter anomalies are then judged by the qualitative rules of Section III-D in windows of w'=100 same-template entries. The method is evaluated on BGL, HDFS, ThunderBird, and Spirit against DeepLog, LogAnomaly, Logsy, and LogBERT, with reported F1 scores of 0.95-0.97 versus 0.60-0.92 for baselines (Table II), a robustness study under 60%, 50%, and 40% training splits (Table III), and ablations that remove either branch. The paper claims to be the first to consider event templates and parameters jointly.

Significance. The paper addresses a real gap: most log anomaly detectors rely on template sequence prediction alone and discard parameter semantics, and the four-dataset evaluation with a reduced-training robustness axis (Table III) is a useful stress test. The template branch is concretely specified, the reported F1 values are internally arithmetically consistent, and the ablation design (TPLogAD with and without each branch) is the right way to attribute credit. If the reported margins are reproducible, the combination of semantic template vectors with typed parameter encodings would be a practical contribution to operational log analysis. The obstacle is that the parameter branch is the load-bearing component and its specification is incomplete: the anomaly rules in Section III-D are qualitative, the para2vec vectors are never connected to those rules, the fusion of the two branches into per-log predictions is not defined, and Tables II and III report single-run numbers. The direction is sound and the core idea is plausible; what is missing is algorithmic precision and variance information rather than plausibility.

major comments (4)
  1. [Section III-C and III-D] The parameter-anomaly criteria in Section III-D are stated only qualitatively ('exceed the reasonable range', 'consistent with the majority of user identifications', 'changes too frequently', 'association with other parameters of the same type is low'), with no numeric thresholds, no algorithms, and, critically, no reference to the para2vec encodings defined in Section III-C (Eqs. 3-5). The rules as written operate on raw values and formats, not on the vector representations, so the proposed encodings play no demonstrated role in the decision procedure. Since Table II credits the parameter branch with improving both precision and recall on all four datasets relative to TPLogAD without para2vec, and since no fusion rule is given for combining template-branch and parameter-branch flags into the per-log predictions behind the reported metrics, the attribution of the reported gains to the joint template-plus-parameter representation is unsupported. The absence of reported thresholds also leaves open the possibility that the rules were tuned to these benchmark test sets; the revision should state how every threshold is derived from training data alone.
  2. [Section III-E and III-B] The handling of unmatched templates in Section III-E maps every real-time log entry without a matching template to the existing template vector with the highest similarity, with no minimum-similarity threshold and no procedure for incorporating the new template into the model. Under this design a genuinely new event type (for example, a newly introduced failure class in the 40%-training setting of Table III) is always absorbed by the nearest old template, which could mask a true anomaly or alias a normal new event to an unrelated old one. The Section IV-C robustness claim therefore needs a stated rejection threshold or statistical test for the similarity decision, and an ablation that isolates the update mechanism as the source of the robustness rather than a uniform nearest-neighbor mapping.
  3. [Section IV-A and IV-B] Tables II and III report single-run point estimates with no variance, confidence intervals, or significance tests, and the evaluation unit is not stated: the definitions in Section IV-A are per log entry, whereas HDFS is typically benchmarked at session/block level, and the four datasets in Table I differ enormously in anomaly ratio (roughly 0.15% for HDFS to 63.5% for Spirit). Without variance estimates and a stated evaluation unit, the reported margin (F1 0.95-0.97 versus 0.60-0.92 for the strongest baselines) cannot be assessed for statistical meaning, and the per-entry versus per-session choice can change the comparison materially. Baseline hyperparameters and tuning procedures are also not described, which limits the reproducibility of the comparison.
  4. [Section III-A, III-C, III-D] Two load-bearing design elements are under-specified. First, 'the main parameters are first extracted from the parameter sequence via Kmeans clustering algorithm' (Section III-C and Fig. 4) does not state what features are clustered, how many clusters are used, or how clusters select key parameters. Second, the joint learning objective is unclear: the BiLSTM predicts the next template in the template branch, while the parameter branch is judged by the hand-written rules of Section III-D, and the only description of fusion is that 'the template vector and parameter vector are combined and input into the BiLSTM' (Section III-A) and 'the vector representations of each parameter are merged according to their types' (Section III-D). There is no formal account of what the BiLSTM learns about parameters or of how the two branches contribute to the final anomaly flag for a log entry.
minor comments (9)
  1. [Section IV-B] The manuscript uses several spellings for the same components ('itemplate2vec', 'itemplate2vec', and the method name 'TPLoqAD' in Section IV-B); please standardize the terminology throughout.
  2. [Section III-C] Equation (5) has an unbalanced parenthesis: Vstate = fbin to num(fvec to bin(fone hot(s)) is missing a closing bracket.
  3. [Section IV-C] The sentence reporting results 'across all training set divisions of the two datasets' refers to four datasets; correct the phrasing.
  4. [Section I] The claim that 'this is the first log anomaly detection that considers both event templates and parameters jointly' is not substantiated by the related-work discussion, given that [9] and [13] already process parameter information; please qualify the claim or define 'jointly' precisely.
  5. [Section III-C] The 64-bit hash of user identifiers is described as encryption that prevents adversaries from recovering the original information; a 64-bit hash is not encryption and is vulnerable to offline lookup attacks, so the privacy claim should be rephrased.
  6. [Section IV-C] The statement that 'approximately 12.6% of the test data, which equates to 239,338 log entries' cannot be matched is confusing because it follows a description of the 80/20 split from Section IV-A; clarify that this statistic refers to the 60/40 split used in Table III.
  7. [Section IV-A] The F1-score formula contains the typo 'P ercision' and the prose has mechanical errors ('idnetification', 'fone hot', 'Bert' vs. 'BERT', 'Log-system is'); a careful copyedit is needed.
  8. [Section II] Reference [18] is cited for Drain3, but it describes the original Drain algorithm; the Drain3 implementation should be cited separately or the version should be specified.
  9. [Section III-B] The statement that BERT is fine-tuned on historical logs lacks the objective and the data: for BGL the 60% training split contains only 602 templates, so the fine-tuning task, epochs, and handling of placeholders like '<*>' need to be specified.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: TPLogAD is validated against external benchmark labels; the under-specified parameter thresholds in Section III-D are a reproducibility/fitting risk, not a circular derivation.

full rationale

TPLogAD's derivation chain is self-contained and externally evaluated. The two claimed contributions are deterministic feature transformations: itemplate2vec reweights BERT embeddings by within-template cosine similarity (Eqs. 1-2), and para2vec applies per-type encodings (Eqs. 3-5, z-score, one-hot-to-integer, TF-IDF). None of these equations is defined in terms of the anomaly labels or the anomaly score. The template branch is a BiLSTM next-template predictor (Section III-D) trained on an 80% split and tested on a disjoint 20% split against ground-truth labels from public datasets (BGL, HDFS, ThunderBird, Spirit; Table I), and the parameter branch applies hand-written qualitative rules (reasonable range, majority consistency, change frequency, association) that are likewise scored against those external labels. No fitted parameter is renamed as a prediction: the reported precision/recall/F1 are computed against independent anomaly labels that do not derive from the model's own rules. The reference list contains no works by the present authors (Lu, Wu), so there is no self-citation chain, no imported uniqueness theorem, and no ansatz smuggled via the authors' own prior work. The paper's central claim—joint template-plus-parameter detection outperforming DeepLog, LogAnomaly, Logsy, and LogBERT—stands on held-out evaluation on public data, not on a reduction of outputs to inputs. The one legitimate concern is that Section III-D's parameter criteria such as 'reasonable range' and 'too frequently' are given no numeric thresholds, so the Table II ablation crediting para2vec could in principle be driven by unstated cutoffs tuned to the benchmarks rather than by the proposed vector encodings; that is an underspecification and potential data-fitting risk, not a circular step, because the rules and the labels are distinct and no equation or definition exhibits the claimed result reducing to its own input.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The method introduces no new physical entities. Its central claim rests on hand-set window sizes, an unreported Kmeans cluster count, and unreported parameter thresholds, all of which are free parameters; the domain assumptions above are untested but plausible for log analysis.

free parameters (6)
  • Template window size w = 20
    Hand-set window for BiLSTM next-template prediction (Section IV-B); no sensitivity analysis is reported.
  • Parameter window size w' = 100
    Hand-set window for parameter anomaly checks (Section IV-B); no sensitivity analysis is reported.
  • BiLSTM hidden size = 256
    Chosen by hand in the experiment settings (Section IV-A/B); no tuning details are given.
  • Kmeans cluster count k = not specified
    para2vec uses Kmeans to select key parameters (Section III-C) but the number of clusters and the selection criterion are not provided.
  • Parameter anomaly thresholds = not specified
    The rules in Section III-D (reasonable range, too frequent changes, low association) require concrete bounds and frequencies; these directly control which logs are flagged and are never specified.
  • BERT fine-tuning hyperparameters = not specified
    bert-base-uncased is fine-tuned on historical logs (Section III-B) without reporting epochs, learning rate, or batch size.
assumptions (4)
  • domain assumption Drain3 splits each log entry into templates and parameters accurately on all four datasets.
    Drain3 is used throughout (Section III-A) but parser errors are never evaluated; template and parameter vectors inherit its mistakes.
  • ad hoc to paper The five parameter types (time, user id, value, state, resource id) suffice to represent all parameters that matter for anomaly detection.
    Section III-C asserts these types are common in real logs but gives no per-dataset validation or handling for other parameter kinds.
  • domain assumption Normal behavior is characterized by predictable template order plus the hand-written parameter criteria.
    The anomaly definition in Section III-D assumes next-template prediction and value heuristics capture the labeled anomalies; anomalies outside these patterns would be missed.
  • domain assumption Training on unlabeled log streams that contain anomalous entries still yields a reliable model of normal behavior.
    The offline phase uses 80% of each dataset without filtering anomaly-labeled entries (Section IV-A); contamination is assumed not to distort the learned normal patterns.

how reviews work

0 comments
Cite this review

Pith. "Pith review of TPLogAD: Unsupervised Log Anomaly Detection Based on Event Templates and Key Parameters." pith.science (2026). https://pith.science/paper/SCYEYPCB

@misc{pith2026241115250,
  author       = {Pith},
  title        = {Pith review of: TPLogAD: Unsupervised Log Anomaly Detection Based on Event Templates and Key Parameters},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SCYEYPCB}},
  note         = {Machine review of arXiv:2411.15250}
}
read the original abstract

Log-system is an important mechanism for recording the runtime status and events of Web service systems, and anomaly detection in logs is an effective method of detecting problems. However, manual anomaly detection in logs is inefficient, error-prone, and unrealistic. Existing log anomaly detection methods either use the indexes of event templates, or form vectors by embedding the fixed string part of the template as a sentence, or use time parameters for sequence analysis. However, log entries often contain features and semantic information that cannot be fully represented by these methods, resulting in missed and false alarms. In this paper, we propose TPLogAD, a universal unsupervised method for analyzing unstructured logs, which performs anomaly detection based on event templates and key parameters. The itemplate2vec and para2vec included in TPLogAD are two efficient and easy-to-implement semantic representation methods for logs, detecting anomalies in event templates and parameters respectively, which has not been achieved in previous work. Additionally, TPLogAD can avoid the interference of log diversity and dynamics on anomaly detection. Our experiments on four public log datasets show that TPLogAD outperforms existing log anomaly detection methods.

Figures

Figures reproduced from arXiv: 2411.15250 by the authors.

Figure 1
Figure 1. Logs and templates show that TPLogAD outperforms state-of-the-art log anomaly detection methods. II. BACKGROUND Most log parsing methods view log entries as a combination of event templates and parameters. Event templates are fixed strings that predefined by developers, and describe the type of events recorded by log entries. Parameters are variables used by the program to provide details of a log entry. However, wh… view at source ↗
Figure 3
Figure 3. Examples of itemplate2vec meaning and purpose of the log entry recording a certain type of event. The parameters contain the event’s association information, including the time, location, status, and attribute value of the event. This information may reflect the dynamic changes of the system status and imply rules and constrains of these changes under normal situation. The main concept of our model is to utilize dee… view at source ↗
Figure 4
Figure 4. Examples of para2vec and associative representations of logs that reflect the true meaning and purpose of logs, log parameters can be combined with the semantic information of event templates. For effective use of log parameter information, it is necessary to convert it into vector representations for anomaly detection, thus ensuring objectivity and precision in the analysis of the logs. Time2vec [15] is a vector en… view at source ↗
Figures from the paper (2 more)
Figure 5
Figure 5. Figure 5: Examples of Template Anomaly [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 6
Figure 6. Figure 6: Examples of Parameter Anomaly the original information while increasing their computability. This transforms log analysis and anomaly detection into classic vector operations and machine learning problems, improving effectiveness and efficiency of log anomaly detection…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

25 extracted references · 19 canonical work pages

  1. [1]

    S. He, P. He, Z. Chen, T. Yang, Y . Su, and M. Lyu, ”A survey on automated log analysis for reliability engineering,” ACM computing surveys (CSUR), 54(6):1–37, 2021

  2. [2]

    Landauer, S

    M. Landauer, S. Onder, F. Skopik, and M. Wurzenberger, ”Deep learning for anomaly detection in log data: A survey,” Machine Learning with Applications, 12:100470, 2023

  3. [3]

    Landauer, F

    M. Landauer, F. Skopik, M. Frank, W. Hotwagner, M. Wurzenberger, and A. Rauber, ”Maintainable log datasets for evaluation of intrusion detection systems,” IEEE Transactions on Dependable and Secure Computing, 2022

  4. [4]

    S. He, J. Zhu, P. He, and M. Lyu, ”Loghub: A large collection of system log datasets towards automated log analytics,” arXiv preprint arXiv:2008.06448, 2020

  5. [5]

    W. Meng, Y . Liu, Y . Zhu, S. Zhang, D. Pei, Y . Liu, Y . Chen, R. Zhang, S. Tao, P. Sun and R Zhou, ”Loganomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs,” In IJCAI, volume 19, pages 4739–4745, 2019

  6. [6]

    Zhang, Y

    X. Zhang, Y . Xu, Q. Lin, B. Qiao, H. Zhang, Y . Dang, C. Xie, X. Yang, Q. Cheng, Z. Li, et al, ”Robust log-based anomaly detection on unstable log data,” In Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering , pages 807–817, 2019

  7. [7]

    Nedelkoski, J

    S. Nedelkoski, J. Bogatinovski, A. Acker, J. Cardoso, and O. Kao, ”Self- attentive classification-based anomaly detection in unstructured logs,” In 2020 IEEE International Conference on Data Mining (ICDM) , pages 1196–1201. IEEE, 2020

  8. [8]

    M. Du, F. Li, G. Zheng, and V . Srikumar, ”Deeplog: Anomaly detection and diagnosis from system logs through deep learning,” In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pages 1285–1298, 2017

Show all 25 references
  1. [9]

    F. Liu, Y . Wen, D. Zhang, X. Jiang, X. Xing, and D. Meng, ”Log2vec: A heterogeneous graph embedding based approach for detecting cyber threats within enterprise,” In Proceedings of the 2019 ACM SIGSAC con- ference on computer and communications security , pages 1777–1794, 2019

  2. [10]

    T. Jia, Y . Wu, C. Hou, and Y . Li, ”Logflash: Real-time streaming anomaly detection and diagnosis from system logs for large-scale software systems,” In 2021 IEEE 32nd International Symposium on Software Reliability Engineering (ISSRE) , pages 80–90. IEEE, 2021

  3. [11]

    Z. Li, J. Shi, and M. Leeuwen, ”Graph neural network based log anomaly detection and explanation,” arXiv preprint arXiv:2307.00527 , 2023

  4. [12]

    Y . Sui, Y . Zhang, J. Sun, T. Xu, S. Zhang, Z. Li, Y . Sun, et al, ”Logkg: Log failure diagnosis through knowledge graph,” IEEE Transactions on Services Computing, 2023

  5. [13]

    Sutthipanyo, T

    T. Sutthipanyo, T. Lamsan, W. Thawornsusin, and W. Susutti, ”Log- based anomaly detection using CNN model with parameter entity labeling for improving log preprocessing approach,” In TENCON 2023- 2023 IEEE Region 10 Conference (TENCON) , pages 914–919. IEEE, 2023

  6. [14]

    Devlin, M

    J. Devlin, M. Chang, K. Lee, and K. Toutanova, ”Bert: Pre-training of deep bidirectional transformers for language understanding,” arXiv preprint arXiv:1810.04805, 2018

  7. [15]

    Kazemi, R

    S. Kazemi, R. Goel, S. Eghbali, J. Ramanan, J. Sahota, S. Thakur, S. Wu, C. Smyth, P. Poupart, and M. Brubaker, ”Time2vec: Learning a vector representation of time,” arXiv preprint arXiv:1907.05321 , 2019

  8. [16]

    J. Zhu, S. He, J. Liu, P. He, Q. Xie, Z. Zheng, and M. Lyu, ”Tools and benchmarks for automated log parsing,” In 2019 IEEE/ACM 41st Inter- national Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP), pages 121–130. IEEE, 2019

  9. [17]

    Zhang, H

    T. Zhang, H. Qiu, G. Castellano, M. Rifai, C. Chen, and F. Pianese, ”System log parsing: A survey,” IEEE Transactions on Knowledge and Data Engineering, 2023

  10. [18]

    P. He, J. Zhu, Z. Zheng, and M. Lyu, ”Drain: An online log parsing approach with fixed depth tree.” In 2017 IEEE international conference on web services (ICWS) , pages 33–40. IEEE, 2017

  11. [19]

    Z. Khan, D. Shin, D. Bianculli, and L. Briand, ”Guidelines for assessing the accuracy of log message template identification techniques,” In Pro- ceedings of the 44th International Conference on Software Engineering , pages 1095–1106, 2022

  12. [20]

    H. Guo, S. Yuan, and X. Wu, ”LogBERT: Log anomaly detection via bert,” In 2021 International Joint Conference on Neural Networks (IJCNN), pages 1–8. IEEE, 2021

  13. [21]

    Oliner and J

    A. Oliner and J. Stearley, ”What supercomputers say: A study of five system logs,” In 37th annual IEEE/IFIP international conference on dependable systems and networks (DSN’07) , pages 575–584. IEEE, 2007

  14. [22]

    Mikolov, K

    T. Mikolov, K. Chen, G. Corrado, and J. Dean, ”Efficient estimation of word representations in vector space,” arXiv preprint arXiv:1301.3781 , 2013

  15. [23]

    Nguyen, S

    K. Nguyen, S. Walde, and N. Vu, ”Integrating distributional lexical contrast into word embeddings for antonym-synonym distinction,” arXiv preprint arXiv:1605.07766, 2016

  16. [24]

    Jalilifard, V

    A. Jalilifard, V . Carid ´a, A. Mansano, R. Cristo, and F. Fonseca, ”Semantic sensitive tf-idf to determine word relevance in documents,” In Advances in Computing and Network Communications: Proceedings of CoCoNet 2020, Volume 2 , pages 327–337. Springer, 2021

  17. [25]

    W. Xu, L. Huang, A. Fox, D. Patterson, and M. Jordan, ”Largescale system problem detection by mining console logs,” Proceedings of SOSP’09, 2009

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.