# Detecting Log Anomalies with Multi-Head Attention (LAMA)

arXiv: https://arxiv.org/abs/2101.02392 · HTML: https://mlsanity.com/paper/2101.02392/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 2 of its 13 references that are in the map.
- First posted on arXiv 7 Jan 2021.

## Builds on (most cited first, 2 of 2)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [Recurrent Neural Network Attention Mechanisms for Interpretable System Log Anomaly Detection](https://mlsanity.com/paper/1803.04967/) (2018)

## Built on by (most cited first, 3 of 3)

- [AI for IT Operations (AIOps) on Cloud Platforms: Reviews, Opportunities and Challenges](https://mlsanity.com/paper/2304.04661/) (2023)
- [AIOps-Driven Enhancement of Log Anomaly Detection in Unsupervised Scenarios](https://mlsanity.com/paper/2311.02621/) (2023)
- [A unified framework for detecting point and collective anomalies in operating system logs via collaborative transformers](https://mlsanity.com/paper/2512.23380/) (2025)

## Abstract (arXiv)

Anomaly detection is a crucial and challenging subject that has been studied within diverse research areas. In this work, we explore the task of log anomaly detection (especially computer system logs and user behavior logs) by analyzing logs' sequential information. We propose LAMA, a multi-head attention based sequential model to process log streams as template activity (event) sequences. A next event prediction task is applied to train the model for anomaly detection. Extensive empirical studies demonstrate that our new model outperforms existing log anomaly detection methods including statistical and deep learning methodologies, which validate the effectiveness of our proposed method in learning sequence patterns of log data.