# Recurrent Neural Network Attention Mechanisms for Interpretable System Log Anomaly Detection

arXiv: https://arxiv.org/abs/1803.04967 · HTML: https://mlsanity.com/paper/1803.04967/

## Key facts

- Cited by 21 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Mar 2018.

## Built on by (most cited first, 21 of 21)

- [A Survey on Explainable Anomaly Detection](https://mlsanity.com/paper/2210.06959/) (2022)
- [LAnoBERT: System Log Anomaly Detection based on BERT Masked Language Model](https://mlsanity.com/paper/2111.09564/) (2021)
- [SoK: Explainable Machine Learning for Computer Security Applications](https://mlsanity.com/paper/2208.10605/) (2022)
- [AI for IT Operations (AIOps) on Cloud Platforms: Reviews, Opportunities and Challenges](https://mlsanity.com/paper/2304.04661/) (2023)
- [A2Log: Attentive Augmented Log Anomaly Detection](https://mlsanity.com/paper/2109.09537/) (2021)
- [Diverse Counterfactual Explanations for Anomaly Detection in Time Series](https://mlsanity.com/paper/2203.11103/) (2022)
- [Why Should I Choose You? AutoXAI: A Framework for Selecting and Tuning eXplainable AI Solutions](https://mlsanity.com/paper/2210.02795/) (2022)
- [Log Anomaly Detection with Large Language Models via Knowledge-Enriched Fusion](https://mlsanity.com/paper/2512.11997/) (2025)
- [Trustworthy Anomaly Detection: A Survey](https://mlsanity.com/paper/2202.07787/) (2022)
- [Predictive Querying for Autoregressive Neural Sequence Models](https://mlsanity.com/paper/2210.06464/) (2022)
- [Detecting Log Anomalies with Multi-Head Attention (LAMA)](https://mlsanity.com/paper/2101.02392/) (2021)
- [On Improving Deep Learning Trace Analysis with System Call Arguments](https://mlsanity.com/paper/2103.06915/) (2021)
- [Crypto Pump and Dump Detection via Deep Learning Techniques](https://mlsanity.com/paper/2205.04646/) (2022)
- [Fine-grained Anomaly Detection in Sequential Data via Counterfactual Explanations](https://mlsanity.com/paper/2210.04145/) (2022)
- [A Fuzzy Logic-Based Framework for Explainable Machine Learning in Big Data Analytics](https://mlsanity.com/paper/2510.05120/) (2025)
- [Towards interpreting ML-based automated malware detection models: a survey](https://mlsanity.com/paper/2101.06232/) (2021)
- [Language Models for Novelty Detection in System Call Traces](https://mlsanity.com/paper/2309.02206/) (2023)
- [MINES: Explainable Anomaly Detection through Web API Invariant Inference](https://mlsanity.com/paper/2512.06906/) (2025)
- [RAPID: Training-free Retrieval-based Log Anomaly Detection with PLM considering Token-level information](https://mlsanity.com/paper/2311.05160/) (2023)
- [Efficient IoT Intrusion Detection with an Improved Attention-Based CNN-BiLSTM Architecture](https://mlsanity.com/paper/2503.19339/) (2025)
- [A Survey of Heterogeneous Graph Neural Networks for Cybersecurity Anomaly Detection](https://mlsanity.com/paper/2510.26307/) (2025)

## Abstract (arXiv)

Deep learning has recently demonstrated state-of-the art performance on key tasks related to the maintenance of computer systems, such as intrusion detection, denial of service attack detection, hardware and software system failures, and malware detection. In these contexts, model interpretability is vital for administrator and analyst to trust and act on the automated analysis of machine learning models. Deep learning methods have been criticized as black box oracles which allow limited insight into decision factors. In this work we seek to "bridge the gap" between the impressive performance of deep learning models and the need for interpretable model introspection. To this end we present recurrent neural network (RNN) language models augmented with attention for anomaly detection in system logs. Our methods are generally applicable to any computer system and logging source. By incorporating attention variants into our RNN language models we create opportunities for model introspection and analysis without sacrificing state-of-the art performance. We demonstrate model performance and illustrate model interpretability on an intrusion detection task using the Los Alamos National Laboratory (LANL) cyber security dataset, reporting upward of 0.99 area under the receiver operator characteristic curve despite being trained only on a single day's worth of data.