# Self-Attentive Classification-Based Anomaly Detection in Unstructured Logs

arXiv: https://arxiv.org/abs/2008.09340 · HTML: https://mlsanity.com/paper/2008.09340/

## Key facts

- Cited by 36 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 21 Aug 2020.

## Built on by (most cited first, 30 of 36)

- [Log-based Anomaly Detection Without Log Parsing](https://mlsanity.com/paper/2108.01955/) (2021)
- [Log-based Anomaly Detection with Deep Learning: How Far Are We?](https://mlsanity.com/paper/2202.04301/) (2022)
- [Experience Report: Deep Learning-based System Log Analysis for Anomaly Detection](https://mlsanity.com/paper/2107.05908/) (2021)
- [LogGPT: Exploring ChatGPT for Log-Based Anomaly Detection](https://mlsanity.com/paper/2309.01189/) (2023)
- [LAnoBERT: System Log Anomaly Detection based on BERT Masked Language Model](https://mlsanity.com/paper/2111.09564/) (2021)
- [Deep Learning for Anomaly Detection in Log Data: A Survey](https://mlsanity.com/paper/2207.03820/) (2022)
- [Deep transfer learning for intrusion detection in industrial control networks: A comprehensive review](https://mlsanity.com/paper/2304.10550/) (2023)
- [AI for IT Operations (AIOps) on Cloud Platforms: Reviews, Opportunities and Challenges](https://mlsanity.com/paper/2304.04661/) (2023)
- [Robust and Transferable Anomaly Detection in Log Data using Pre-Trained Language Models](https://mlsanity.com/paper/2102.11570/) (2021)
- [A2Log: Attentive Augmented Log Anomaly Detection](https://mlsanity.com/paper/2109.09537/) (2021)
- [Artificial Intelligence for IT Operations (AIOPS) Workshop White Paper](https://mlsanity.com/paper/2101.06054/) (2021)
- [OneLog: Towards End-to-End Training in Software Log Anomaly Detection](https://mlsanity.com/paper/2104.07324/) (2021)
- [LogLAB: Attention-Based Labeling of Log Data Anomalies via Weak Supervision](https://mlsanity.com/paper/2111.01657/) (2021)
- [On the Effectiveness of Log Representation for Log-based Anomaly Detection](https://mlsanity.com/paper/2308.08736/) (2023)
- [Demystifying and Extracting Fault-indicating Information from Logs for Failure Diagnosis](https://mlsanity.com/paper/2409.13561/) (2024)
- [LogELECTRA: Self-supervised Anomaly Detection for Unstructured Logs](https://mlsanity.com/paper/2402.10397/) (2024)
- [FastLogAD: Log Anomaly Detection with Mask-Guided Pseudo Anomaly Generation and Discrimination](https://mlsanity.com/paper/2404.08750/) (2024)
- [PULL: Reactive Log Anomaly Detection Based On Iterative PU Learning](https://mlsanity.com/paper/2301.10681/) (2023)
- [LogAI: A Library for Log Analytics and Intelligence](https://mlsanity.com/paper/2301.13415/) (2023)
- [LUK: Empowering Log Understanding with Expert Knowledge from Large Language Models](https://mlsanity.com/paper/2409.01909/) (2024)
- [ADALog: Adaptive Unsupervised Anomaly detection in Logs with Self-attention Masked Language Model](https://mlsanity.com/paper/2505.13496/) (2025)
- [Leveraging Log Instructions in Log-based Anomaly Detection](https://mlsanity.com/paper/2207.03206/) (2022)
- [AI based Log Analyser: A Practical Approach](https://mlsanity.com/paper/2203.10960/) (2022)
- [Failure Identification from Unstable Log Data using Deep Learning](https://mlsanity.com/paper/2204.02636/) (2022)
- [CSCLog: A Component Subsequence Correlation-Aware Log Anomaly Detection Method](https://mlsanity.com/paper/2307.03359/) (2023)
- [RAPID: Training-free Retrieval-based Log Anomaly Detection with PLM considering Token-level information](https://mlsanity.com/paper/2311.05160/) (2023)
- [What Information Contributes to Log-based Anomaly Detection? Insights from a Configurable Transformer-Based Approach](https://mlsanity.com/paper/2409.20503/) (2024)
- [TPLogAD: Unsupervised Log Anomaly Detection Based on Event Templates and Key Parameters](https://mlsanity.com/paper/2411.15250/) (2024)
- [RationAnomaly: Log Anomaly Detection with Rationality via Chain-of-Thought and Reinforcement Learning](https://mlsanity.com/paper/2509.14693/) (2025)
- [A Comprehensive Forecasting-Based Framework for Time Series Anomaly Detection: Benchmarking on the Numenta Anomaly Benchmark (NAB)](https://mlsanity.com/paper/2510.11141/) (2025)

## Abstract (arXiv)

The detection of anomalies is essential mining task for the security and reliability in computer systems. Logs are a common and major data source for anomaly detection methods in almost every computer system. They collect a range of significant events describing the runtime system status. Recent studies have focused predominantly on one-class deep learning methods on predefined non-learnable numerical log representations. The main limitation is that these models are not able to learn log representations describing the semantic differences between normal and anomaly logs, leading to a poor generalization of unseen logs. We propose Logsy, a classification-based method to learn log representations in a way to distinguish between normal data from the system of interest and anomaly samples from auxiliary log datasets, easily accessible via the internet. The idea behind such an approach to anomaly detection is that the auxiliary dataset is sufficiently informative to enhance the representation of the normal data, yet diverse to regularize against overfitting and improve generalization. We propose an attention-based encoder model with a new hyperspherical loss function. This enables learning compact log representations capturing the intrinsic differences between normal and anomaly logs. Empirically, we show an average improvement of 0.25 in the F1 score, compared to the previous methods. To investigate the properties of Logsy, we perform additional experiments including evaluation of the effect of the auxiliary data size, the influence of expert knowledge, and the quality of the learned log representations. The results show that the learned representation boost the performance of the previous methods such as PCA with a relative improvement of 28.2%.