Pith. sign in

REVIEW 4 major objections 6 minor 42 references

A plug-in that fuses reusable log semantics with existing detectors recovers nearly all missed anomalies and explains why a session is flagged.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-12 01:16 UTC pith:SPFSFBU7

load-bearing objection Solid plug-in systems paper: multi-backbone recall recovery plus reusable evidence banks, with the main risk that validation-tuned fusion and training n-grams do a lot of the heavy lifting. the 4 major comments →

arxiv 2607.03599 v1 pith:SPFSFBU7 submitted 2026-07-03 cs.SE

LogSemFuse: Semantic Evidence Fusion for Explainable Log Anomaly Detection

Hassan Jabri , Zeyang Ma , Zhijie Wang , Tse-Hsun Chen This is my paper
classification cs.SE
keywords log anomaly detectionsemantic reasoninglarge language modelsknowledge reuseexplainable AIevent patternsexecutable ruleslog analysis
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Existing log anomaly detectors often miss anomalous sessions and return only scores or labels, leaving operators without operational reasons for an alert. LogSemFuse leaves those detectors unchanged and adds three kinds of reusable semantic evidence: short local event patterns, cluster-derived executable rules, and cached LLM session judgments. At inference it fuses the backbone signal with those evidence signals and returns the final label together with the patterns, rules, and rationale that support it. On HDFS, BGL, and Liberty with four standard backbones, the method improves every non-perfect baseline, recovers 98.8% of backbone false negatives, and yields explanations people prefer over free-form LLM text, at modest fixed inference cost. The practical claim is that semantic augmentation can raise both detection and interpretability without replacing pipelines or calling an LLM on every session.

Core claim

LogSemFuse shows that existing model-based log anomaly detectors can be strengthened and made explainable by fusing their outputs at decision time with reusable semantic evidence—discriminative local event n-grams, HDBSCAN-cluster-derived executable rules induced once by an LLM, and cached session-level LLM high-risk judgments—without changing backbone training or architecture. Across three public benchmarks and four backbones, this plug-in recovers 2,056 of 2,081 backbone false negatives (98.8%), improves every non-perfect baseline F1 while preserving the already perfect case, and produces evidence-based explanations rated higher than direct LLM explanations in a 14-person study, with only

What carries the argument

LogSemFuse: a four-signal evidence-guided fusion layer. Training builds a fixed knowledge bank of anomaly-oriented unigram/bigram/trigram patterns and cluster-derived rules (primitives: contains_ngram, ordered_subset, min_count, absent_within); inference matches those artifacts, reuses or caches LLM session rationale, and combines backbone, pattern, rule, and LLM binary signals via a validation-chosen OR/AND/vote-k policy to decide and explain.

Load-bearing premise

Patterns and rules mined only from earlier training anomalies, plus fusion thresholds and policy tuned on validation, stay discriminative on later test sessions without precision collapse or leakage.

What would settle it

Rerun the same chronological 70/10/20 split protocol on a held-out production log stream whose failure modes are absent from the training window; if F1 gains and false-negative recovery vanish while false positives rise, the claim that training-time semantic banks transfer fails.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Operators can keep current DeepLog/LogAnomaly/LogBERT/NeuralLog pipelines and still recover most sessions those models alone miss.
  • Anomaly alerts can ship with concrete evidence—fired n-grams, triggered operational rules, and expected-vs-observed rationale—rather than only a score.
  • LLM cost for log analysis can be amortized: rules and patterns are built once, session rationales are cached by identifier, so cost scales with novel patterns not total session volume.
  • When a backbone already hits perfect F1, the plug-in need not change the decision and still supplies explanation artifacts.
  • Ablations imply local event patterns carry most of the detection lift, while rules and LLM signals mainly add complementary coverage and explanation grounding.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same knowledge-bank pattern—mine local discriminators, cluster failures into executable rules, cache LLM judgments—could plug into other sequence monitors (traces, metrics alerts) where models output scores without operational semantics.
  • If production templates drift, the fixed training bank would go stale; a natural extension is incremental re-mining or rule invalidation when pattern support on recent normal traffic spikes.
  • Human preference for grounded multi-source explanations over free-form LLM text suggests that tying language to deterministic matchers may matter more for operator trust than better prose alone.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. LogSemFuse is a plug-in framework that leaves existing log anomaly detectors unchanged and fuses their session-level decisions with three semantic evidence channels: training-mined local EventId n-grams, HDBSCAN cluster-derived executable rules induced by an LLM, and a temperature-0 gpt-4o-mini session judgment (is_high_risk + confidence). Evidence is stored in a knowledge bank and reused at inference; the final label is produced by a validation-selected fusion operator F over four binary signals, and explanations cite fired patterns, triggered rules, and LLM rationale. On HDFS, BGL, and Liberty with DeepLog, LogAnomaly, LogBERT, and NeuralLog, the paper reports F1 gains on every non-perfect baseline, preservation of the perfect LogAnomaly–Liberty case, recovery of 2,056/2,081 backbone false negatives (98.8%), modest stable inference overhead, and higher human preference for its explanations than direct LLM text (N=14).

Significance. If the reported gains transfer beyond these chronological public splits, the work is a practical contribution to software reliability engineering: it shows how to improve and explain existing detectors without retraining them, amortize LLM cost via reusable pattern/rule banks, and attach operational evidence rather than free-form post-hoc text. Strengths include multi-backbone multi-dataset evaluation, chronological 70/10/20 splits, component ablations (Table VI), training-size sensitivity (Table VII), runtime and token accounting (Table IV), and a within-subject human study with Wilcoxon tests (Table V). The plug-in design and constrained rule schema are concrete engineering artifacts that other detectors can adopt.

major comments (4)
  1. [§III-D, Table III] §III-D (Eqs. 4–5) and Table III: the headline claim—every non-perfect baseline improved and 98.8% of backbone FNs recovered—depends on the validation-chosen fusion operator F ∈ {OR, AND, vote-k} and thresholds τ_b, τ_ℓ. The manuscript never reports which F and thresholds were selected per dataset–backbone, nor the per-channel true/false positive and false-negative counts (how many recovered FNs fire only sn, only sr, only sℓ, or combinations). Without that attribution, it is impossible to tell whether gains are multi-evidence fusion or effectively OR over highly precise training-mined n-grams/rules. Please report selected policies and a per-signal contribution breakdown for Table III.
  2. [Table VI, RQ4] Table VI: removing local event patterns collapses several strong results (LogBERT HDFS 0.99→0.36; BGL 1.00→0.56; Liberty DeepLog 0.96→0.71), while removing LLM-based reasoning changes most rows by ≤0.02 and only hurts LogBERT–Liberty substantially (0.99→0.90). The abstract and introduction frame LogSemFuse as multi-source semantic fusion including LLM reasoning; the ablation shows detection is dominated by n-grams, with rules and LLM secondary for accuracy. Either reframe the detection contribution accordingly or add analysis showing when non-pattern channels uniquely recover FNs that patterns miss.
  3. [§III-B, §IV-A, RQ1] §III-B, §IV-A, and the 98.8% FN-recovery claim in RQ1: K_ngram and K_rule are mined only from chronological training anomalies and applied read-only at test time. The paper does not measure whether test anomalies share templates, n-grams, or HDBSCAN-like event distributions with training clusters (e.g., fraction of test anomalies that match any training pattern/rule; cluster coverage of test FNs). If future failures differ from the training anomaly vocabulary, the reported recovery would not transfer—the exact condition the central effectiveness claim needs. Add a train–test anomaly overlap / coverage analysis and discuss failure modes when novel anomalies appear.
  4. [Table III, §V RQ1] Table III precision jumps for weak backbones (LogBERT BGL 0.66→1.00; LogBERT Liberty 0.29→1.00) imply that fused semantic signals almost never fire on normal test sessions. That is possible but needs verification: report absolute FP counts for the backbone alone versus each evidence channel and the fused system, and confirm that validation tuning of F did not overfit rare normal-session pattern collisions. Precision preservation is load-bearing for the claim that semantic augmentation does not trade precision for recall.
minor comments (6)
  1. [Table IV, Abstract] Table IV: training-stage overhead is large (e.g., DeepLog HDFS 21s→2416s) while the abstract emphasizes “modest and stable inference-time overhead.” Clarify early that training cost is one-time LLM/cluster construction and keep the modest claim scoped to inference.
  2. [§IV-A] §IV-A: Liberty uses a contiguous 550k-line slice (1,589 sessions). State selection criteria and whether results are sensitive to the slice window; the small anomaly count (260) makes perfect LogAnomaly and large relative gains harder to generalize.
  3. [§V RQ3] RQ3 human study: one author selected the 10 sessions; report sampling criteria, inter-rater agreement if any, and whether participants saw ground-truth labels. N=14 is acceptable for a pilot but should be framed as such.
  4. [§III-B, §IV-C] §III-B: HDBSCAN parameters, n-gram support/lift thresholds, and window size w=20 are free parameters; list validation-selected values in an appendix for reproducibility.
  5. [Figure 1, §III-D] Figure 1 is dense; a short algorithm box for inference (match patterns → match rules → cache/LLM → fuse → assemble evidence) would help readers implement the plug-in interface.
  6. [§II-B] Related work: briefly contrast decision-level fusion with training-time hybrid detectors (LogRobust, PLELog) so the “plug-in without changing training” claim is sharper.

Circularity Check

0 steps flagged

No derivation-by-construction circularity: LogSemFuse is an empirical plug-in evaluated on held-out chronological test sessions, not a first-principles claim that reduces to its inputs.

full rationale

The paper’s load-bearing claims are empirical (Table III F1 gains; 2,056/2,081 backbone FN recovery; human preference for explanations), not a closed-form derivation. Training-time artifacts (K_ngram from anomalous/normal support and lift; HDBSCAN clusters → LLM rules into K_rule) are built only from the training split and kept read-only at test time; session-level LLM reasoning is cached without ground-truth labels; fusion policy and thresholds (OR/AND/vote-k, τ_b, τ_ℓ) are selected on validation and then applied to a later chronological test partition (Sections III-B, III-D, IV-A). That is standard supervised mining plus hyperparameter selection on held-out data, not self-definitional equivalence or a fitted parameter renamed as a prediction of the same quantity. Ablations (Table VI) further show independent content: removing patterns or rules changes F1 rather than leaving a tautology. Self-citations (e.g., related-work survey) are not uniqueness theorems that force the method. Residual risks (validation-chosen fusion, train–test anomaly similarity) are generalization/correctness concerns, not circular reduction of the central claim to its inputs. Score 0 with empty steps is therefore the honest finding.

Axiom & Free-Parameter Ledger

7 free parameters · 6 axioms · 3 invented entities

The central empirical claim rests on standard log-anomaly pipeline assumptions, validation-chosen fusion knobs, and training-only semantic artifacts treated as fixed at test time. No new physical entities are postulated; the ‘invented’ pieces are engineering constructs (knowledge bank, rule primitives, fusion operator). Free parameters are the main degrees of freedom that make the reported F1 sensitive.

free parameters (7)
  • fusion_policy_and_vote_k
    OR / AND / vote-k selected on validation (Section III-D); directly determines how the four binary signals become the final label.
  • backbone_threshold_tau_b
    Validation-selected threshold converting backbone score a_b(x) to s_b(x) (Eq. 4).
  • llm_confidence_threshold_tau_ell
    Validation-selected confidence gate for LLM high-risk signal s_ℓ(x) (Eq. 3).
  • ngram_support_and_lift_thresholds
    Anomalous/normal support and minimum lift plus validation F1 filtering define K_ngram (Section III-B.1); values not fully enumerated.
  • window_size_and_stride
    Fixed w=20, s=1 for window-based backbones (Section IV-C); affects backbone scores fed into fusion.
  • hdbscan_clustering_configuration
    HDBSCAN groups anomalous training sessions before rule induction (Section III-B.2); cluster membership shapes K_rule.
  • train_val_test_split_ratios
    Fixed 70%/10%/20% chronological session split (Section IV-A); changes available patterns/rules and reported metrics.
axioms (6)
  • domain assumption Drain-parsed EventId sequences and dataset-specific sessionization (block ID, node, host-time bucket) preserve the operational unit of anomaly labels.
    Invoked in Sections III-A and IV-A; all modeling and evidence matching operate on these sessions.
  • domain assumption Short contiguous n-grams that are more frequent in anomalous than normal training sessions are discriminative evidence of anomaly at test time.
    Core of Module I (Section III-B.1); ablation shows largest drops when patterns are removed.
  • domain assumption HDBSCAN clusters of TF-IDF EventId vectors of anomalous training sessions correspond to reusable operational failure modes that can be compiled into executable rules.
    Section III-B.2; rules fire deterministically at inference without further LLM calls.
  • ad hoc to paper A temperature-0 gpt-4o-mini structured judgment (expected/observed/is_high_risk/confidence) is a useful complementary binary signal when confidence ≥ τ_ℓ.
    Section III-C and IV-C; model choice and structured schema are paper-specific design choices.
  • ad hoc to paper Late fusion of four binary signals without changing backbone training is a valid way to claim plug-in improvement of existing detectors.
    Sections I and III-D; the evaluation compares backbone vs fused decisions under this interface.
  • domain assumption Standard classification metrics (session Precision/Recall/F1) and Likert ratings of explanation quality measure the intended operational value.
    Sections IV-B and RQ3; construct-validity limits are noted in Section VI.
invented entities (3)
  • Knowledge bank K (K_ngram + K_rule + session LLM cache) no independent evidence
    purpose: Store reusable patterns, executable rules, and cached session rationales so inference can avoid repeated LLM work.
    Introduced in Section III as the central reuse mechanism; engineering construct, not a physical entity.
  • Cluster-derived executable rule schema (contains_ngram, ordered_subset, min_count, absent_within; if_any/if_all) no independent evidence
    purpose: Normalize LLM cluster summaries into deterministic matchers that both detect and explain.
    Section III-B.2 and Figure 2; paper-defined rule language over EventId sequences.
  • Four-signal fusion operator F over (s_b, s_n, s_r, s_ℓ) no independent evidence
    purpose: Produce final session label from backbone plus three semantic evidence modules.
    Equation 5; the operator family is chosen on validation rather than derived.

pith-pipeline@v1.1.0-grok45 · 23070 in / 4261 out tokens · 36825 ms · 2026-07-12T01:16:38.039877+00:00 · methodology

0 comments
read the original abstract

Log anomaly detection is critical for reliability monitoring and failure diagnosis in modern software systems. Existing model-based detectors provide useful anomaly signals, but they can still miss anomalous sessions and typically expose only scores or labels rather than the operational semantics behind a decision. This lack of semantic evidence limits their ability to explain why a session is anomalous, even when the final anomaly label is correct. The gap matters in practice because operators need to distinguish urgent failures from benign deviations and trace suspicious sessions back to concrete operational behavior. LLMs can recover richer log semantics, but using them as standalone detectors or repeatedly generating free-form explanations can be costly and difficult to reuse. We present LogSemFuse, an evidence-guided plug-in framework that enhances existing backbone detectors without replacing their original pipelines. LogSemFuse combines backbone predictions with reusable semantic evidence from local event patterns, LLM-based semantic reasoning, and cluster-derived executable rules to produce both anomaly decisions and evidence-based explanations. The resulting output reports the final label together with the semantic evidence that supports it, such as fired local patterns, triggered rules, and LLM rationale. We evaluate LogSemFuse on HDFS, BGL, and Liberty using DeepLog, LogAnomaly, LogBERT, and NeuralLog as backbones. LogSemFuse improves every non-perfect baseline, preserves the already perfect case, recovers 98.8% of backbone false negatives, and produces explanations preferred over direct LLM explanations in a human study. These gains require only modest and stable inference-time overhead, showing that semantic augmentation can improve detection effectiveness and interpretability without imposing large runtime costs.

Figures

Figures reproduced from arXiv: 2607.03599 by Hassan Jabri, Tse-Hsun Chen, Zeyang Ma, Zhijie Wang.

Figure 1
Figure 1. Figure 1: Overview of LogSemFuse pipeline. denote its sequence of event identifiers. LogSemFuse builds a knowledge bank K containing two types of evidence: a local event-pattern bank Kngram and a cluster-derived rule bank Krule. The local event-pattern bank captures short, discrimi￾native event patterns, whereas the cluster-derived rule bank captures broader recurring operational behaviors summarized from groups of … view at source ↗
Figure 2
Figure 2. Figure 2: Example cluster-level prompt and LLM response for cluster-derived [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: One explanation example from HDFS. RQ4: How do different settings and training-data percentages affect LogSemFuse performance? Motivation. LogSemFuse combines backbone predictions, lo￾cal event patterns, LLM-based semantic reasoning signals, and explanation-derived executable rules. Understanding how these components contribute is necessary for interpreting the augmented decision process. It is also import… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

42 extracted references · 5 linked inside Pith

  1. [1]

    Shilin He, Jieming Zhu, Pinjia He, and Michael R. Lyu. Experience report: System log analysis for anomaly detection. In2016 IEEE 27th International Symposium on Software Reliability Engineering (ISSRE), pages 207–218, 2016

    2016

  2. [2]

    Shilin He, Pinjia He, Zhuangbin Chen, Tianyi Yang, Yuxin Su, and Michael R. Lyu. A survey on automated log analysis for reliability engineering.ACM Computing Surveys, 54(6):1–37, 2021

    2021

  3. [3]

    Jieming Zhu, Shilin He, Pinjia He, Jinyang Liu, and Michael R. Lyu. Loghub: A large collection of system log datasets for ai-driven log analytics. In2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE), pages 355–366, 2023

    2023

  4. [4]

    Spell: Streaming parsing of system event logs

    Min Du and Feifei Li. Spell: Streaming parsing of system event logs. In2016 IEEE 16th International Conference on Data Mining (ICDM), pages 859–864, 2016

    2016

  5. [5]

    Pinjia He, Jieming Zhu, Zibin Zheng, and Michael R. Lyu. Drain: An online log parsing approach with fixed depth tree. In2017 IEEE International Conference on Web Services (ICWS), pages 33–40, 2017

    2017

  6. [6]

    Zanis Ali Khan, Donghwan Shin, Domenico Bianculli, and Lionel C. Briand. Impact of log parsing on deep learning-based anomaly detection. Empirical Software Engineering, 29(139), 2024

    2024

  7. [7]

    Deeplog: Anomaly detection and diagnosis from system logs through deep learn- ing

    Min Du, Feifei Li, Guineng Zheng, and Vasant Srikumar. Deeplog: Anomaly detection and diagnosis from system logs through deep learn- ing. InProceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pages 1285–1298, 2017

    2017

  8. [8]

    Loganomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs

    Weibin Meng, Ying Liu, Yichen Zhu, Shenglin Zhang, Dan Pei, Yuqing Liu, Yihao Chen, Ruizhi Zhang, Shimin Tao, Pei Sun, and Rong Zhou. Loganomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs. InProceedings of the 28th International Joint Conference on Artificial Intelligence, pages 4739–4745, 2019

    2019

  9. [9]

    Logbert: Log anomaly detection via bert

    Haixuan Guo, Shuhan Yuan, and Xintao Wu. Logbert: Log anomaly detection via bert. In2021 International Joint Conference on Neural Networks (IJCNN), pages 1–8, 2021

    2021

  10. [10]

    Robust log-based anomaly detection on unstable log data

    Xu Zhang, Yong Xu, Qingwei Lin, Bo Qiao, Hongyu Zhang, Yingnong Dang, Chunyu Xie, Xinsheng Yang, Qian Cheng, Ze Li, et al. Robust log-based anomaly detection on unstable log data. InProceedings of the 2019 27th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE 2019), pages 807–817, 2019

    2019

  11. [11]

    Semi-supervised log-based anomaly detection via probabilistic label estimation

    Lin Yang, Junjie Chen, Zan Wang, Weijing Wang, Jiajun Jiang, Xuyuan Dong, and Wenbin Zhang. Semi-supervised log-based anomaly detection via probabilistic label estimation. In2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE), pages 1461–1472, 2021

    2021

  12. [12]

    Log-based anomaly detection without log parsing

    Van-Hoang Le and Hongyu Zhang. Log-based anomaly detection without log parsing. In2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE), 2021

    2021

  13. [13]

    Vera Liao, Daniel Gruen, and Sarah Miller

    Q. Vera Liao, Daniel Gruen, and Sarah Miller. Questioning the ai: Informing design practices for explainable ai user experiences. InPro- ceedings of the 2020 CHI Conference on Human Factors in Computing Systems, CHI ’20, pages 1–15, New York, NY , USA, 2020. Association for Computing Machinery

    2020

  14. [14]

    Vera Liao, and Rachel K

    Yunfeng Zhang, Q. Vera Liao, and Rachel K. E. Bellamy. Effect of confidence and explanation on accuracy and trust calibration in ai- assisted decision making. InProceedings of the 2020 Conference on Fairness, Accountability, and Transparency, FAT* ’20, pages 295–305, New York, NY , USA, 2020. Association for Computing Machinery

    2020

  15. [15]

    Deepseer: Interactive rnn explanation and debugging via state abstrac- tion

    Zhijie Wang, Yuheng Huang, Da Song, Lei Ma, and Tianyi Zhang. Deepseer: Interactive rnn explanation and debugging via state abstrac- tion. InProceedings of the 2023 CHI Conference on Human Factors in Computing Systems, 2023

    2023

  16. [16]

    why should i trust you?

    Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. “why should i trust you?”: Explaining the predictions of any classifier. InProceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pages 1135–1144, 2016

    2016

  17. [17]

    Lundberg and Su-In Lee

    Scott M. Lundberg and Su-In Lee. A unified approach to interpreting model predictions. InAdvances in Neural Information Processing Systems, volume 30, pages 4765–4774, 2017

    2017

  18. [18]

    Fung, Hailong Yang, Dongxiao Qian, Jiahua Shang, Zhongzhi Xiao, and Zhenzhou Wu

    Jiaxing Qi, Shaohan Huang, Zhongzhi Luan, Carol J. Fung, Hailong Yang, Dongxiao Qian, Jiahua Shang, Zhongzhi Xiao, and Zhenzhou Wu. Exploring chatgpt for log-based anomaly detection. In2023 IEEE 25th International Conference on High Performance Computing and Communications (HPCC), 2023

    2023

  19. [19]

    Logprompt: A log-based anomaly detection framework using prompts

    Ting Zhang, Xin Huang, Wen Zhao, Shaohuang Bian, and Peng Du. Logprompt: A log-based anomaly detection framework using prompts. In2023 International Joint Conference on Neural Networks (IJCNN), pages 1–8, 2023

    2023

  20. [20]

    Interpretable online log analysis using large language models with prompt strategies

    Yilun Liu, Shimin Tao, Weibin Meng, Jingyu Wang, Wenbing Ma, Yanqing Zhao, Yuhang Chen, Hao Yang, Yanfei Jiang, and Xun Chen. Interpretable online log analysis using large language models with prompt strategies. InProceedings of the 32nd IEEE/ACM International Conference on Program Comprehension, pages 35–46, 2024

    2024

  21. [21]

    Logllm: Log-based anomaly detection using large language models

    Wei Guan, Jian Cao, Shiyou Qian, Jianqi Gao, and Chun Ouyang. Logllm: Log-based anomaly detection using large language models. arXiv preprint arXiv:2411.08561, 2024

    Pith/arXiv arXiv 2024

  22. [22]

    Are self-explanations from large language models faithful?arXiv preprint arXiv:2401.07927, 2024

    Andreas Madsen, Sarath Chandar, and Siva Reddy. Are self-explanations from large language models faithful?arXiv preprint arXiv:2401.07927, 2024

    Pith/arXiv arXiv 2024

  23. [23]

    GPT-4o mini: advancing cost-efficient intelligence

    OpenAI. GPT-4o mini: advancing cost-efficient intelligence. https: //openai.com/index/gpt-4o-mini-advancing-cost-efficient-intelligence/,

  24. [24]

    Accessed: 2026-06-16

    2026

  25. [25]

    Zhihan Jiang, Jinyang Liu, Junjie Huang, Yichen Li, Yintong Huo, Jiazhen Gu, Zhuangbin Chen, Jieming Zhu, and Michael R. Lyu. A large-scale evaluation for log parsing techniques: How far are we? In Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis, pages 223–234, 2024

    2024

  26. [26]

    Wei Xu, Ling Huang, Armando Fox, David Patterson, and Michael I. Jordan. Detecting large-scale system problems by mining console logs. InProceedings of the ACM SIGOPS 22nd Symposium on Operating Systems Principles (SOSP ’09), pages 117–132, 2009

    2009

  27. [27]

    Mining invariants from console logs for system problem detection

    Jian-Guang Lou, Qiang Fu, Shengqi Yang, Ye Xu, and Jiang Li. Mining invariants from console logs for system problem detection. InProceed- ings of the 2010 USENIX Annual Technical Conference (USENIX ATC), pages 1–14, 2010

    2010

  28. [28]

    Log clustering based problem identification for online service systems

    Qingwei Lin, Hongyu Zhang, Jian-Guang Lou, Yu Zhang, and Xuewei Chen. Log clustering based problem identification for online service systems. InProceedings of the 38th International Conference on Software Engineering Companion, pages 102–111, 2016

    2016

  29. [29]

    Fung, Rong He, Yining Zhao, Hailong Yang, and Zhongzhi Luan

    Shaohan Huang, Yi Liu, Carol J. Fung, Rong He, Yining Zhao, Hailong Yang, and Zhongzhi Luan. Hitanomaly: Hierarchical transformers for anomaly detection in system log.IEEE Transactions on Network and Service Management, 17(4):2064–2076, 2020

    2064

  30. [30]

    Loggd: Detecting anomalies from system logs with graph neural networks

    Yongzheng Xie, Hongyu Zhang, and Muhammad Ali Babar. Loggd: Detecting anomalies from system logs with graph neural networks. In2022 IEEE 22nd International Conference on Software Quality, Reliability and Security (QRS), pages 299–310, 2022

    2022

  31. [31]

    Logformer: A pre-train and tuning pipeline for log anomaly detection

    Hongcheng Guo, Jian Yang, Jiaheng Liu, Jiaqi Bai, Boyang Wang, Zhoujun Li, Tieqiao Zheng, Bo Zhang, Junran Peng, and Qi Tian. Logformer: A pre-train and tuning pipeline for log anomaly detection. InProceedings of the AAAI Conference on Artificial Intelligence, vol- ume 38, pages 135–143, 2024

    2024

  32. [32]

    Logrules: Enhancing log anal- ysis capability of large language models through rules

    Xin Huang, Ting Zhang, and Wen Zhao. Logrules: Enhancing log anal- ysis capability of large language models through rules. InFindings of the Association for Computational Linguistics: NAACL 2025, pages 452– 470, Albuquerque, New Mexico, 2025. Association for Computational Linguistics

    2025

  33. [33]

    LLM4Log: A systematic review of large language model-based log analysis.arXiv preprint arXiv:2604.16359, 2026

    Zeyang Ma, Jinqiu Yang, and Tse-Hsun Chen. LLM4Log: A systematic review of large language model-based log analysis.arXiv preprint arXiv:2604.16359, 2026

    Pith/arXiv arXiv 2026

  34. [34]

    A critical review of common log data sets used for evaluation of sequence-based anomaly detection techniques.arXiv preprint arXiv:2309.02854, 2023

    Max Landauer, Florian Skopik, and Markus Wurzenberger. A critical review of common log data sets used for evaluation of sequence-based anomaly detection techniques.arXiv preprint arXiv:2309.02854, 2023

    Pith/arXiv arXiv 2023

  35. [35]

    Pinpointing anomaly events in logs from stability testing—n-grams vs

    Mika M ¨antyl¨a, Mart ´ın Varela, and Shayan Hashemi. Pinpointing anomaly events in logs from stability testing—n-grams vs. deep- learning. In2022 IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW), pages 285–292, 2022

    2022

  36. [36]

    Term-weighting approaches in automatic text retrieval.Information Processing & Management, 24(5):513–523, 1988

    Gerard Salton and Christopher Buckley. Term-weighting approaches in automatic text retrieval.Information Processing & Management, 24(5):513–523, 1988

    1988

  37. [37]

    Accelerated hierarchical density based clustering

    Leland McInnes and John Healy. Accelerated hierarchical density based clustering. In2017 IEEE International Conference on Data Mining Workshops (ICDMW), pages 33–42, 2017

    2017

  38. [38]

    Clusterlog: Cluster- ing logs for effective log-based anomaly detection.arXiv preprint arXiv:2301.07846, 2023

    Chris Egersdoerfer, Dong Dai, and Di Zhang. Clusterlog: Cluster- ing logs for effective log-based anomaly detection.arXiv preprint arXiv:2301.07846, 2023

    Pith/arXiv arXiv 2023

  39. [39]

    J. A. Hartigan and M. A. Wong. Algorithm as 136: A k-means clustering algorithm.Journal of the Royal Statistical Society. Series C (Applied Statistics), 28(1):100–108, 1979

    1979

  40. [40]

    hdbscan: Hierarchical density based clustering.Journal of Open Source Software, 2(11):205, 2017

    Leland McInnes, John Healy, and Steve Astels. hdbscan: Hierarchical density based clustering.Journal of Open Source Software, 2(11):205, 2017

    2017

  41. [41]

    A technique for the measurement of attitudes.Archives of Psychology, 22(140):1–55, 1932

    Rensis Likert. A technique for the measurement of attitudes.Archives of Psychology, 22(140):1–55, 1932

    1932

  42. [42]

    Individual comparisons by ranking methods.Biomet- rics Bulletin, 1(6):80–83, 1945

    Frank Wilcoxon. Individual comparisons by ranking methods.Biomet- rics Bulletin, 1(6):80–83, 1945

    1945