Pith. sign in

REVIEW 6 major objections 5 minor 7 cited by

LogLLM: Log-based Anomaly Detection Using Large Language Models

T0 review · 6 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims LogLLM, a BERT-to-Llama log anomaly detector with no log parser, outperforms nine prior methods on four public datasets and beats the strongest baseline by 6.6% average F1.

desk verdict Solid engineering result in log anomaly detection, but the SOTA claim is under-tested until the closest LLM baseline is added and the Table II arithmetic is fixed. read the letter →

arxiv 2411.08561 v5 pith:W5TYGURM submitted 2024-11-13 cs.SE cs.AI

Wei Guan , Jian Cao , Shiyou Qian , Jianqi Gao , Chun Ouyang This is my paper · ORCID
classification cs.SEcs.AI
keywords log-basedanomalydetectionlargelanguagemodelsBERTLlamasemanticembeddinglogpreprocessingthree-stagetrainingunstablelogs
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that a supervised log anomaly detector built from two pretrained language models can beat both parser-based and parser-free predecessors. LogLLM masks variable parameters with regular expressions, encodes each log message into a semantic vector with BERT, projects those vectors into Llama's embedding space, and fine-tunes Llama to classify each sequence as normal or anomalous. On HDFS, BGL, Liberty, and Thunderbird, the authors report the highest F1-score among ten methods, with average F1 6.6% above NeuralLog, and they argue that the design removes log-parser dependence and handles unstable logs.

What carries the argument

The load-bearing object is the learned embedding bridge: a frozen BERT encoder with a trainable [CLS]-based semantic-vector head, followed by a single linear projector that maps each message vector into Llama's token-embedding space. The projected vectors are inserted between two textual prompt pieces ("Below is a sequence of system log messages:" and "Is this sequence normal or anomalous?") and fed to Llama. This design gives each log message a clean boundary, avoids concatenating the raw log into a long string, and so sidesteps out-of-memory failures while keeping the semantic knowledge of both pretrained models.

What would settle it

Re-label BGL, Thunderbird, and Liberty using only sequences that can be tied to documented failure incidents (rather than any window containing a flagged message), retrain and retest LogLLM against NeuralLog under the same chronological split; if the average F1 advantage disappears or reverses, the paper's headline claim is an artifact of the window-labeling rule.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that a transformer encoder and a transformer decoder can be joined into one log anomaly detector: BERT summarizes each log message into one vector, a learned linear projector aligns that vector to Llama's token-embedding space, and Llama classifies the resulting sequence. Trained in three stages (answer-template fine-tuning, embedder training, then full fine-tuning), LogLLM is reported to achieve F1-scores of 0.997 on HDFS, 0.916 on BGL, 0.958 on Liberty, and 0.966 on Thunderbird, outperforming all nine compared methods on every dataset. On average the paper computes a 6.6% F1 improvement over the best existing method, NeuralLog.

Load-bearing premise

The entire evaluation rests on treating a 100-message window as anomalous when at least one message inside it is labeled anomalous; if that window rule is not what system operators mean by an anomaly, the reported F1 improvement is an improvement on that labeling rule rather than on real incident detection.

Editorial extensions

If this is right

  • Log parsers are unnecessary: regex masking of parameters yields higher F1 than Drain templates or template IDs on all four datasets.
  • Message-level embedding lets a decoder-only LLM handle sequences of hundreds of messages without out-of-memory errors, which direct raw-text input cannot do.
  • The three-stage training procedure is load-bearing: dropping Stage 1 lowers average F1 by 29.7%.
  • Supervised anomaly labels matter: methods trained with labeled anomalies outperform reconstruction-based and retrieval-based methods on these datasets.
  • Chronological splits make the result relevant to unstable logs, where new templates appear after training.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The 6.6% advantage is measured against window labels built by OR-ing message-level labels; if operators care about incidents rather than any flagged message, the practical gap may differ.
  • Because the method is supervised and benefits from labeled anomalies, its comparison with semi-supervised and training-free alternatives mixes in the effect of supervision, not only the LLM architecture.
  • Regex masking assumes parameters have recognizable formats; logs with free-text variable content would test whether the parser-free advantage survives.
  • The claim of robustness to unstable logs would be sharpened by reporting how many unseen templates appear in the test windows and how LogLLM's F1 varies with that quantity.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 5 minor

Summary. The paper proposes LogLLM, a supervised log-sequence anomaly detection framework that replaces log parsing with regex-based normalization, embeds each log message with BERT, projects the embeddings with a linear layer, and feeds them as soft prompts to Llama for sequence classification. Training relies on minority-class oversampling and a three-stage QLoRA procedure. Experiments on HDFS, BGL, Liberty, and Thunderbird compare against nine baselines and report the highest F1 on all four datasets, with additional ablations on preprocessing, embedder use, Llama size, training stages, and the oversampling parameter β. The paper claims that LogLLM outperforms state-of-the-art methods and that it handles unstable logs without log parsers.

Significance. If the empirical claims hold, the paper makes a useful practical contribution: it avoids fragile log parsers, keeps sequence lengths manageable by embedding individual messages before feeding Llama, and provides a concrete three-stage training recipe. The code is publicly linked, the evaluation uses four real public datasets, and the ablation study is instructive. However, the headline state-of-the-art claim is currently under-supported because the most relevant decoder-only LLM baseline cited in the paper is not evaluated, and at least one baseline number in the main table is internally inconsistent. The comparison is also confounded by model scale, and the unstable-logs claim is not directly measured. With a strengthened comparison and corrected tables, the method could become a solid empirical contribution.

major comments (6)
  1. [V-E, Table II] Section V-E states that LogLLM achieves the highest F1 across all datasets and is 6.6% better than the best existing method, NeuralLog. This comparison omits Hadadi et al. [40], the fine-tuning-based GPT baseline discussed in Section II-B. The two challenges used to dismiss that work (unclear template boundaries and excessive token counts) are claimed to be demonstrated in Section V-G, but Section V-G only tests concatenating raw log messages into Llama-3.2-1B; it does not test Hadadi et al.'s template-based GPT fine-tuning pipeline. Because LogLLM uses Llama-3-8B while NeuralLog uses BERT-base with a small classifier, the observed margin may reflect model scale rather than the proposed architecture. Please add the missing baseline or restrict the state-of-the-art claim to the compared methods.
  2. [V-E, Table II] In the LogAnomaly HDFS row, Precision=0.886 and Recall=0.893 give F1=0.889, not the printed 0.966. This is an arithmetically impossible result and undermines confidence in the transcription or computation of the baseline table. All baseline F1 values should be recomputed from raw predictions and re-verified.
  3. [V-D, V-E, Table I] On Thunderbird, the test set contains only 29 anomalous sequences (0.15%). The reported F1=0.966 therefore corresponds to roughly 28 true positives, 1 false positive, and 1 false negative. The average F1 advantage claimed in Section V-E is thus sensitive to a handful of test instances. Please report per-dataset confidence intervals, repeated runs with different random seeds, or a larger test sample before drawing comparative conclusions.
  4. [V-F, Table IV] The preprocessing comparison applies Drain to the entire dataset, including the test split, to avoid OOV degradation. This leaks test information into the parser in exactly the unstable-log condition the paper claims to address, and it biases the comparison against parser-based preprocessing. Please fit Drain on the training data only, or separately quantify the number of OOV templates that appear in the test split.
  5. [V-B, V-J] The oversampling proportion β is set to 30% in Section V-B after Section V-J reports its test-set F1 curve and concludes that values between 30% and 50% are acceptable. No separate validation set is described, so β selection appears to use test labels. Please introduce a validation split for hyperparameter selection, or present the sensitivity analysis as post-hoc rather than as model selection.
  6. [V-D, Abstract] The abstract's claim that LogLLM handles unstable logs is not directly measured. The chronological splits for BGL, Thunderbird, and Liberty ensure that training precedes test, but the paper reports no statistics on how many new log templates or OOV tokens appear in the test windows, nor how template drift degrades parser-based competitors. Please add a direct drift analysis, such as template novelty rate or vocabulary overlap between train and test, to substantiate this claim.
minor comments (5)
  1. [V-H, Table V] The stated GPU memory increase of 7.7 GB when moving from Llama-3.2-1B to Llama-3-8B does not match Table V; the pairwise average of the reported memory numbers is 6.7 GB. Please check the calculation.
  2. [IV-B, V-G] The architecture is described with a 'projector' in Section IV-B, but Section V-G calls the same component an 'adapter'. Please unify the terminology.
  3. [IV-C3, V-B] Stage 1 is said to require 'only a few data samples' in Section IV-C3, while Section V-B states that 1,000 samples are used. Please clarify how these Stage 1 samples are selected and whether they are drawn from the training set.
  4. [V-F, Table IV] For the 'Template ID' row, the description says template IDs are encoded with an embedding layer instead of BERT; please clarify whether the same LogLLM architecture and three-stage training procedure are used for all four preprocessing variants.
  5. [Table III] The computational-cost table reports timings averaged across datasets but does not specify whether the numbers include GPU warm-up, evaluation, or data loading. Please state the measurement protocol.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the performance claims are held-out empirical comparisons, and the paper's self-citations are background only, not load-bearing.

full rationale

The paper's central claim (Section V-E: 'The proposed LogLLM achieves the highest F1-score across all datasets. On average, LogLLM's F1-scores are 6.6% better than the best existing method, NeuralLog.') is an empirical result computed on held-out test splits described in Section V-D, not a quantity derived from the model's own fitted parameters or from a self-citation. LogLLM is trained on the training split and evaluated on test sequences, so the F1 differences in Table II are not forced by construction: the comparison metrics are computed from independently labeled data and from the compared methods' own reported/configured outputs. The paper introduces its architecture, preprocessing, and three-stage training procedure directly (Sections IV-A through IV-C), and it supports them with ablations in Tables IV-VI rather than by invoking prior work. The self-citations ([4] and [28]) appear only as background context and are not load-bearing for the claimed result. The choice of beta=30% in Section V-B, together with the sensitivity analysis in Section V-J, is a hyperparameter setting and robustness check, not a fitted quantity renamed as a prediction. The omission of Hadadi et al. from the comparison weakens the strength of the 'state-of-the-art' claim as a completeness or correctness concern, but it does not make the derivation circular. No circular step can be exhibited from the paper's text.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The paper makes no theoretical derivation, so the ledger records hyperparameters and dataset/labeling assumptions. The projector is a trained linear layer, not a postulated entity, so no invented entities are listed.

free parameters (4)
  • Minority class oversampling proportion beta = 30% (swept 0-80% in RQ6)
    Controls oversampling via Eq. (1); final value chosen with knowledge of test-set behavior since no separate validation split is described.
  • Sliding window size and step = 100 messages each
    Defines log sequences for BGL, Thunderbird, and Liberty; all sequence-level anomaly ratios depend on this choice.
  • Stage 1 training sample count = 1,000
    Number of examples used to teach Llama the answer template; no sensitivity analysis is provided.
  • Optimization hyperparameters = Learning rates 5e-4 and 5e-5, batch size 16, 2 epochs
    Manually chosen standard values reported in Section V-B without tuning analysis.
assumptions (4)
  • domain assumption A log sequence is anomalous if it contains at least one anomalous log message
    Stated in Section V-D; used to construct all BGL, Thunderbird, and Liberty sequence labels from message-level ground truth.
  • domain assumption Variable parameters in log messages can be identified by regular expressions without log parsers
    Section IV-A assumes regex masking preserves semantic content and avoids out-of-vocabulary issues; no failure analysis on unseen parameter formats is provided.
  • domain assumption Pretrained BERT and Llama representations transfer to system-log language
    Sections IV-B and V assume general-language embeddings and classification abilities apply to log text without domain-specific pretraining.
  • domain assumption Labeled normal and anomalous sequences are available for training
    LogLLM is supervised; the performance comparison in Section V-E groups it with methods that also consume labeled anomalies.

how reviews work

0 comments
Cite this review

Pith. "Pith review of LogLLM: Log-based Anomaly Detection Using Large Language Models." pith.science (2026). https://pith.science/paper/W5TYGURM

@misc{pith2026241108561,
  author       = {Pith},
  title        = {Pith review of: LogLLM: Log-based Anomaly Detection Using Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/W5TYGURM}},
  note         = {Machine review of arXiv:2411.08561}
}
read the original abstract

Software systems often record important runtime information in logs to help with troubleshooting. Log-based anomaly detection has become a key research area that aims to identify system issues through log data, ultimately enhancing the reliability of software systems. Traditional deep learning methods often struggle to capture the semantic information embedded in log data, which is typically organized in natural language. In this paper, we propose LogLLM, a log-based anomaly detection framework that leverages large language models (LLMs). LogLLM employs BERT for extracting semantic vectors from log messages, while utilizing Llama, a transformer decoder-based model, for classifying log sequences. Additionally, we introduce a projector to align the vector representation spaces of BERT and Llama, ensuring a cohesive understanding of log semantics. Unlike conventional methods that require log parsers to extract templates, LogLLM preprocesses log messages with regular expressions, streamlining the entire process. Our framework is trained through a novel three-stage procedure designed to enhance performance and adaptability. Experimental results across four public datasets demonstrate that LogLLM outperforms state-of-the-art methods. Even when handling unstable logs, it effectively captures the semantic meaning of log messages and detects anomalies accurately.

Figures

Figures reproduced from arXiv: 2411.08561 by the authors.

Figure 1
Figure 1. An example of a system log. language and contain a substantial amount of semantic infor￾mation. However, traditional deep learning-based methods face challenges in capturing this information. B. LLMs for Log-based Anomaly Detection Existing LLMs can be categorized into transformer encoder￾based models, such as BERT [43], RoBERTa [44], and Span￾BERT [45], and transformer decoder-based models, including GPT-4 [25], Ll… view at source ↗
Figure 2
Figure 2. Illustrative examples of log message partitioning. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. The framework of LogLLM. Notably, the model includes a single instance of BERT and the projector. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Impact of minority class oversampling. contrast, for the Liberty dataset, when β increases, normal samples are oversampled, making the model more prone to identifying samples as normal. As illustrated in Fig. 4c, the trend of the F1-score is basically the same across a…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 7 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Can Large Language Models Generate Observability-Aware Code?

    cs.SE 2026-07 conditional novelty 6.0 of 10

    AI coding agents produce microservice systems where only 4.95–13.99% of injected faults generate explicit fault signals in logs, revealing a semantic observability gap that lightweight guidance only partially addresses.

  2. GuARD: Effective Anomaly Detection through a Text-Rich and Graph-Informed Language Model

    cs.CL 2024-12 conditional novelty 6.0 of 10

    GuARD progressively injects SLM text summaries and GNN structural vectors into an instruction-tuned LLM to detect anomalous nodes, reporting state-of-the-art results and large speedups over long-context LLM fine-tuning.

  3. LogSemFuse: Semantic Evidence Fusion for Explainable Log Anomaly Detection

    cs.SE 2026-07 conditional novelty 5.0 of 10

    A plug-in fuses backbone scores with n-gram patterns, LLM risk labels, and cluster-derived rules, recovering 98.8% of false negatives and preferred explanations on HDFS, BGL, and Liberty.

  4. ALPHA: LLM-Enabled Active Learning for Human-Free Network Anomaly Detection

    cs.NI 2025-09 conditional novelty 5.0 of 10

    ALPHA uses LLM majority-vote labels on a few cluster representatives, propagates them to all logs, and trains SVM/Logistic Regression detectors that match fully supervised F1 on Thunderbird.

  5. FALCON: Transforming Cyber Threat Intelligence into Deployable IDS Rules with Self-Reflection

    cs.CR 2025-08 conditional novelty 5.0 of 10

    FALCON automates the generation of Snort and YARA intrusion detection rules from cyber threat intelligence using an LLM agent pipeline with a contrastively trained CTI-rule semantic scorer as a ground-truth-free validator.

  6. Large Language Models for Security Operations Centers: A Comprehensive Survey

    cs.CR 2025-09 conditional novelty 4.0 of 10

    A systematic review of 138 papers classifying LLM applications in SOC workflows by phase, model family, datasets, and maturity.

  7. Domain Specific Benchmarks for Evaluating Multimodal Large Language Models

    cs.LG 2025-06 conditional novelty 3.0 of 10

    A review paper that organizes domain-specific MLLM benchmarks into an eight-discipline taxonomy, with summary tables and performance highlights.

Reference graph

Works this paper leans on

57 extracted references · 25 canonical work pages · cited by 7 Pith papers

  1. [40]

    Anomaly detection on unstable logs with gpt models,

    F. Hadadi, Q. Xu, D. Bianculli, and L. Briand, “Anomaly detection on unstable logs with gpt models,” arXiv preprint arXiv:2406.07467, 2024

    arXiv 2024

  2. [1]

    Reliable and highly available distributed publish/subscribe service,

    R. S. Kazemzadeh and H.-A. Jacobsen, “Reliable and highly available distributed publish/subscribe service,” in 2009 28th IEEE International Symposium on Reliable Distributed Systems . IEEE, 2009, pp. 41–50

    work page 2009

  3. [2]

    Bauer and R

    E. Bauer and R. Adams, Reliability and availability of cloud computing . John Wiley & Sons, 2012

    work page 2012

  4. [3]

    Log-based anomaly detection without log pars- ing,

    V .-H. Le and H. Zhang, “Log-based anomaly detection without log pars- ing,” in 2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE) . IEEE, 2021, pp. 492–504

    2021

  5. [4]

    Survey and benchmark of anomaly detection in business processes,

    W. Guan, J. Cao, H. Zhao, Y . Gu, and S. Qian, “Survey and benchmark of anomaly detection in business processes,” IEEE Transactions on Knowledge and Data Engineering , pp. 1–23, 2024

    work page 2024

  6. [5]

    End-to-end automl for unsupervised log anomaly detection,

    S. Zhang, Y . Ji, J. Luan, X. Nie, Z. Chen, M. Ma, Y . Sun, and D. Pei, “End-to-end automl for unsupervised log anomaly detection,” Automated Software Engineering (ASE’24) , 2024

    work page 2024

  7. [6]

    Log-based anomaly detection with deep learning: How far are we?

    V .-H. Le and H. Zhang, “Log-based anomaly detection with deep learning: How far are we?” in Proceedings of the 44th international conference on software engineering , 2022, pp. 1356–1367

    2022

  8. [7]

    Loggpt: Exploring chatgpt for log-based anomaly detection,

    J. Qi, S. Huang, Z. Luan, S. Yang, C. Fung, H. Yang, D. Qian, J. Shang, Z. Xiao, and Z. Wu, “Loggpt: Exploring chatgpt for log-based anomaly detection,” in 2023 IEEE International Conference on High Performance Computing & Communications, Data Science & Systems, Smart City & Dependability in Sensor, Cloud & Big Data Systems & Application (HPCC/DSS/SmartCi...

    work page 2023

Show all 57 references
  1. [8]

    Deeplog: Anomaly detection and diagnosis from system logs through deep learning,

    M. Du, F. Li, G. Zheng, and V . Srikumar, “Deeplog: Anomaly detection and diagnosis from system logs through deep learning,” in Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, 2017, pp. 1285–1298

    2017

  2. [9]

    Loganomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs

    W. Meng, Y . Liu, Y . Zhu, S. Zhang, D. Pei, Y . Liu, Y . Chen, R. Zhang, S. Tao, P. Sunet al., “Loganomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs.” in IJCAI, vol. 19, no. 7, 2019, pp. 4739–4745

    2019

  3. [10]

    Logattn: Unsupervised log anomaly detection with an autoencoder based attention mechanism,

    L. Zhang, W. Li, Z. Zhang, Q. Lu, C. Hou, P. Hu, T. Gui, and S. Lu, “Logattn: Unsupervised log anomaly detection with an autoencoder based attention mechanism,” in International conference on knowledge science, engineering and management . Springer, 2021, pp. 222–235

    2021

  4. [11]

    Autolog: Anomaly detection by deep autoencoding of system logs,

    M. Catillo, A. Pecchia, and U. Villano, “Autolog: Anomaly detection by deep autoencoding of system logs,” Expert Systems with Applications , vol. 191, p. 116263, 2022

    2022

  5. [12]

    Log anomaly detection by adversarial autoencoders with graph feature fusion,

    Y . Xie and K. Yang, “Log anomaly detection by adversarial autoencoders with graph feature fusion,” IEEE Transactions on Reliability , 2023

    2023

  6. [13]

    Anomaly detection model for log based on lstm network and variational autoencoder,

    X. Zhang, X. Chai, M. Yu, and D. Qiu, “Anomaly detection model for log based on lstm network and variational autoencoder,” in 2023 4th International Conference on Information Science, Parallel and Distributed Systems (ISPDS) . IEEE, 2023, pp. 239–244

    2023

  7. [14]

    A generative adversarial networks for log anomaly detection

    X. Duan, S. Ying, W. Yuan, H. Cheng, and X. Yin, “A generative adversarial networks for log anomaly detection.”Comput. Syst. Sci. Eng., vol. 37, no. 1, pp. 135–148, 2021

    2021

  8. [15]

    Graph-based log anomaly detection via adversarial training,

    Z. He, Y . Tang, K. Zhao, J. Liu, and W. Chen, “Graph-based log anomaly detection via adversarial training,” in International Symposium on Dependable Software Engineering: Theories, Tools, and Applications. Springer, 2023, pp. 55–71

    2023

  9. [16]

    Layerlog: Log sequence anomaly detection based on hierarchical se- mantics,

    C. Zhang, X. Wang, H. Zhang, J. Zhang, H. Zhang, C. Liu, and P. Han, “Layerlog: Log sequence anomaly detection based on hierarchical se- mantics,” Applied Soft Computing , vol. 132, p. 109860, 2023

    2023

  10. [17]

    Onelog: towards end-to-end software log anomaly detection,

    S. Hashemi and M. Mäntylä, “Onelog: towards end-to-end software log anomaly detection,” Automated Software Engineering , vol. 31, no. 2, p. 37, 2024

    2024

  11. [18]

    Detecting anomaly in big data system logs using convolutional neural network,

    S. Lu, X. Wei, Y . Li, and L. Wang, “Detecting anomaly in big data system logs using convolutional neural network,” in 2018 IEEE 16th Intl Conf on Dependable, Autonomic and Secure Computing, 16th Intl Conf on Pervasive Intelligence and Computing, 4th Intl Conf on Big Data Inte...

    2018

  12. [19]

    Robust log-based anomaly detection on unstable log data,

    X. Zhang, Y . Xu, Q. Lin, B. Qiao, H. Zhang, Y . Dang, C. Xie, X. Yang, Q. Cheng, Z. Li et al., “Robust log-based anomaly detection on unstable log data,” in Proceedings of the 2019 27th ACM joint meeting on European software engineering conference and symposium on the foundat...

    2019

  13. [20]

    Loggd: Detecting anomalies from system logs with graph neural networks,

    Y . Xie, H. Zhang, and M. A. Babar, “Loggd: Detecting anomalies from system logs with graph neural networks,” in 2022 IEEE 22nd International conference on software quality, reliability and security (QRS). IEEE, 2022, pp. 299–310

    2022

  14. [21]

    Trine: Syslog anomaly detection with three transformer encoders in one gen- erative adversarial network,

    Z. Zhao, W. Niu, X. Zhang, R. Zhang, Z. Yu, and C. Huang, “Trine: Syslog anomaly detection with three transformer encoders in one gen- erative adversarial network,” Applied Intelligence , vol. 52, no. 8, pp. 8810–8819, 2022

    2022

  15. [22]

    Semi-supervised log-based anomaly detection via probabilistic label estimation,

    L. Yang, J. Chen, Z. Wang, W. Wang, J. Jiang, X. Dong, and W. Zhang, “Semi-supervised log-based anomaly detection via probabilistic label estimation,” in 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE) . IEEE, 2021, pp. 1448–1460

    2021

  16. [23]

    Long short-term memory,

    S. Hochreiter, “Long short-term memory,” Neural Computation MIT- Press, 1997

    1997

  17. [24]

    Attention is all you need,

    A. Vaswani, “Attention is all you need,” Advances in Neural Information Processing Systems, 2017

    2017

  18. [25]

    Gpt-4 technical report,

    J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkat et al. , “Gpt-4 technical report,” arXiv preprint arXiv:2303.08774 , 2023

    2023 arXiv

  19. [26]

    The llama 3 herd of models,

    A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Yang, A. Fan et al. , “The llama 3 herd of models,” arXiv preprint arXiv:2407.21783 , 2024

    2024 arXiv

  20. [27]

    Chatglm: A family of large language models from glm-130b to glm-4 all tools,

    T. GLM, A. Zeng, B. Xu, B. Wang, C. Zhang, D. Yin, D. Rojas, G. Feng, H. Zhao, H. Lai et al. , “Chatglm: A family of large language models from glm-130b to glm-4 all tools,” arXiv preprint arXiv:2406.12793 , 2024

    2024 arXiv

  21. [28]

    Dabl: Detecting semantic anomalies in business processes using large language models,

    W. Guan, J. Cao, J. Gao, H. Zhao, and S. Qian, “Dabl: Detecting semantic anomalies in business processes using large language models,” arXiv preprint arXiv:2406.15781 , 2024

    2024

  22. [29]

    Logprompt: Prompt engineering towards zero-shot and interpretable log analysis,

    Y . Liu, S. Tao, W. Meng, F. Yao, X. Zhao, and H. Yang, “Logprompt: Prompt engineering towards zero-shot and interpretable log analysis,” in Proceedings of the 2024 IEEE/ACM 46th International Conference on Software Engineering: Companion Proceedings , 2024, pp. 364–365

    2024

  23. [30]

    Early exploration of using chatgpt for log-based anomaly detection on parallel file systems logs,

    C. Egersdoerfer, D. Zhang, and D. Dai, “Early exploration of using chatgpt for log-based anomaly detection on parallel file systems logs,” in Proceedings of the 32nd International Symposium on High-Performance Parallel and Distributed Computing , 2023, pp. 315–316

    2023

  24. [31]

    Raglog: Log anomaly detection using retrieval augmented generation,

    J. Pan, W. S. Liang, and Y . Yidi, “Raglog: Log anomaly detection using retrieval augmented generation,” in 2024 IEEE World Forum on Public Safety Technology (WFPST). IEEE, 2024, pp. 169–174

    2024

  25. [32]

    Logbert: Log anomaly detection via bert,

    H. Guo, S. Yuan, and X. Wu, “Logbert: Log anomaly detection via bert,” in 2021 international joint conference on neural networks (IJCNN) . IEEE, 2021, pp. 1–8

    2021

  26. [33]

    Lanobert: System log anomaly detection based on bert masked language model,

    Y . Lee, J. Kim, and P. Kang, “Lanobert: System log anomaly detection based on bert masked language model,” Applied Soft Computing , vol. 146, p. 110689, 2023

    2023

  27. [34]

    Fastlogad: Log anomaly detection with mask-guided pseudo anomaly generation and discrimination,

    Y . Lin, H. Deng, and X. Li, “Fastlogad: Log anomaly detection with mask-guided pseudo anomaly generation and discrimination,” arXiv preprint arXiv:2404.08750, 2024

    2024 arXiv

  28. [35]

    Logfit: Log anomaly detection using fine-tuned language models,

    C. Almodovar, F. Sabrina, S. Karimi, and S. Azad, “Logfit: Log anomaly detection using fine-tuned language models,” IEEE Transactions on Network and Service Management , 2024

    2024

  29. [36]

    Bert-log: Anomaly detection for system logs based on pre-trained language model,

    S. Chen and H. Liao, “Bert-log: Anomaly detection for system logs based on pre-trained language model,” Applied Artificial Intelligence , vol. 36, no. 1, p. 2145642, 2022

    2022

  30. [37]

    Sarlog: Semantic-aware robust log anomaly detection via bert-augmented contrastive learning,

    J. L. Adeba, D.-H. Kim, and J. Kwak, “Sarlog: Semantic-aware robust log anomaly detection via bert-augmented contrastive learning,” IEEE Internet of Things Journal , 2024

    2024

  31. [38]

    Mlog: Mogrifier lstm-based log anomaly detection approach using semantic representation,

    Y . Fu, K. Liang, and J. Xu, “Mlog: Mogrifier lstm-based log anomaly detection approach using semantic representation,” IEEE Transactions on Services Computing , vol. 16, no. 5, pp. 3537–3549, 2023

    2023

  32. [39]

    Training-free retrieval-based log anomaly detection with pre-trained language model considering token- level information,

    G. No, Y . Lee, H. Kang, and P. Kang, “Training-free retrieval-based log anomaly detection with pre-trained language model considering token- level information,” Engineering Applications of Artificial Intelligence , vol. 133, p. 108613, 2024

    2024

  33. [41]

    The working limitations of large language models,

    M. Burtsev, M. Reeves, and A. Job, “The working limitations of large language models,” MIT Sloan Management Review , vol. 65, no. 2, pp. 8–10, 2024

    2024

  34. [42]

    Fasttext. zip: Compressing text classification models,

    A. Joulin, “Fasttext. zip: Compressing text classification models,” arXiv preprint arXiv:1612.03651, 2016

    2016 arXiv

  35. [43]

    Bert: Pre-training of deep bidirectional transformers for language understanding,

    J. Devlin, “Bert: Pre-training of deep bidirectional transformers for language understanding,” arXiv preprint arXiv:1810.04805 , 2018

    2018 arXiv

  36. [44]

    Roberta: A robustly optimized bert pretraining approach,

    Y . Liu, “Roberta: A robustly optimized bert pretraining approach,” arXiv preprint arXiv:1907.11692, 2019

    1907 arXiv

  37. [45]

    Spanbert: Improving pre-training by representing and predicting spans,

    M. Joshi, D. Chen, Y . Liu, D. S. Weld, L. Zettlemoyer, and O. Levy, “Spanbert: Improving pre-training by representing and predicting spans,” Transactions of the association for computational linguistics , vol. 8, pp. 64–77, 2020

    2020

  38. [46]

    Retrieval- augmented generation for knowledge-intensive nlp tasks,

    P. Lewis, E. Perez, A. Piktus, F. Petroni, V . Karpukhin, N. Goyal, H. Küttler, M. Lewis, W.-t. Yih, T. Rocktäschel et al. , “Retrieval- augmented generation for knowledge-intensive nlp tasks,” Advances in Neural Information Processing Systems , vol. 33, pp. 9459–9474, 2020

    2020

  39. [47]

    Tools and benchmarks for automated log parsing,

    J. Zhu, S. He, J. Liu, P. He, Q. Xie, Z. Zheng, and M. R. Lyu, “Tools and benchmarks for automated log parsing,” in 2019 IEEE/ACM 41st In- ternational Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) . IEEE, 2019, pp. 121–130

    2019

  40. [48]

    An evaluation study on log parsing and its use in log mining,

    P. He, J. Zhu, S. He, J. Li, and M. R. Lyu, “An evaluation study on log parsing and its use in log mining,” in 2016 46th annual IEEE/IFIP international conference on dependable systems and networks (DSN) . IEEE, 2016, pp. 654–661

    2016

  41. [49]

    Online system problem detection by mining patterns of console logs,

    W. Xu, L. Huang, A. Fox, D. Patterson, and M. Jordan, “Online system problem detection by mining patterns of console logs,” in 2009 ninth IEEE international conference on data mining . IEEE, 2009, pp. 588– 597

    2009

  42. [50]

    What supercomputers say: A study of five system logs,

    A. Oliner and J. Stearley, “What supercomputers say: A study of five system logs,” in 37th annual IEEE/IFIP international conference on dependable systems and networks (DSN’07) . IEEE, 2007, pp. 575– 584

    2007

  43. [51]

    Drain: An online log parsing approach with fixed depth tree,

    P. He, J. Zhu, Z. Zheng, and M. R. Lyu, “Drain: An online log parsing approach with fixed depth tree,” in 2017 IEEE international conference on web services (ICWS) . IEEE, 2017, pp. 33–40

    2017

  44. [52]

    Spell: Streaming parsing of system event logs,

    M. Du and F. Li, “Spell: Streaming parsing of system event logs,” in 2016 IEEE 16th International Conference on Data Mining (ICDM) . IEEE, 2016, pp. 859–864

    2016

  45. [53]

    Log parsing with prompt-based few-shot learning,

    V .-H. Le and H. Zhang, “Log parsing with prompt-based few-shot learning,” in 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE). IEEE, 2023, pp. 2438–2449

    2023

  46. [54]

    Probabilistic interpretation of feedforward classification network outputs, with relationships to statistical pattern recognition,

    J. S. Bridle, “Probabilistic interpretation of feedforward classification network outputs, with relationships to statistical pattern recognition,” in Neurocomputing: Algorithms, architectures and applications. Springer, 1990, pp. 227–236

    1990

  47. [55]

    Qlora: Efficient finetuning of quantized llms,

    T. Dettmers, A. Pagnoni, A. Holtzman, and L. Zettlemoyer, “Qlora: Efficient finetuning of quantized llms,” Advances in Neural Information Processing Systems, vol. 36, 2024

    2024

  48. [56]

    Decoupled weight decay regularization,

    I. Loshchilov, “Decoupled weight decay regularization,” arXiv preprint arXiv:1711.05101, 2017

    2017 arXiv

  49. [57]

    Loghub: A large collection of system log datasets for ai-driven log analytics,

    J. Zhu, S. He, P. He, J. Liu, and M. R. Lyu, “Loghub: A large collection of system log datasets for ai-driven log analytics,” in 2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE) . IEEE, 2023, pp. 355–366

    2023

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.