LogBERT: Log Anomaly Detection via BERT
Not on the map. Why?
Abstract (arXiv)
Detecting anomalous events in online computer systems is crucial to protect the systems from malicious attacks or malfunctions. System logs, which record detailed information of computational events, are widely used for system status analysis. In this paper, we propose LogBERT, a self-supervised framework for log anomaly detection based on Bidirectional Encoder Representations from Transformers (BERT). LogBERT learns the patterns of normal log sequences by two novel self-supervised training tasks and is able to detect anomalies where the underlying patterns deviate from normal log sequences. The experimental results on three log datasets show that LogBERT outperforms state-of-the-art approaches for anomaly detection.
Key facts. Cited by 114 papers in the map (data through 7 Oct 2026). First posted on arXiv 7 Mar 2021.
Builds on
No reference list yet.
Built on by
Citing papers per year: 2021: 6; 2022: 10; 2023: 18; 2024: 22; 2025: 27; 2026: 31.
114 papers.
Sort:
By area:
- 2023RCAgent: Cloud Root Cause Analysis by Autonomous Agents with Tool-Augmented Large Language Modelscited by 62
- 2021Log-based Anomaly Detection Without Log Parsingcited by 59
- 2022Log-based Anomaly Detection with Deep Learning: How Far Are We?cited by 56
- 2021LAnoBERT: System Log Anomaly Detection based on BERT Masked Language Modelcited by 30
- 2022Deep Learning for Anomaly Detection in Log Data: A Surveycited by 27
- 2023LogGPT: Log Anomaly Detection via GPTcited by 26
- 2024mABC: multi-Agent Blockchain-Inspired Collaboration for root cause analysis in micro-services architecturecited by 26
- 2024Transformers and Large Language Models for Efficient Intrusion Detection Systems: A Comprehensive Surveycited by 21
- 2024LogLLM: Log-based Anomaly Detection Using Large Language Modelscited by 21
- 2022Tele-Knowledge Pre-training for Fault Analysiscited by 18
- 2022CAN-BERT do it? Controller Area Network Intrusion Detection System based on BERT Language Modelcited by 17
- 2023AI for IT Operations (AIOps) on Cloud Platforms: Reviews, Opportunities and Challengescited by 13
38 more
- 2022MAD: Self-Supervised Masked Anomaly Detection Task for Multivariate Time Seriescited by 12
- 2021UniLog: Deploy One Model and Specialize it for All Log Analysis Taskscited by 11
- 2026TrajAudit: Automated Failure Diagnosis for Agentic Coding Systemscited by 11
- 2021A2Log: Attentive Augmented Log Anomaly Detectioncited by 10
- 2025Large Language Models for Security Operations Centers: A Comprehensive Surveycited by 9
- 2022A Survey on XAI for 5G and Beyond Security: Technical Aspects, Challenges and Research Directionscited by 8
- 2022LogLG: Weakly Supervised Log Anomaly Detection via Log-Event Graph Constructioncited by 8
- 2023Graph Neural Networks based Log Anomaly Detection and Explanationcited by 8
- 2021OneLog: Towards End-to-End Training in Software Log Anomaly Detectioncited by 7
- 2023A Critical Review of Common Log Data Sets Used for Evaluation of Sequence-based Anomaly Detection Techniquescited by 7
- 2024Reducing Events to Augment Log-based Anomaly Detection Models: An Empirical Studycited by 7
- 2023Learning Representations on Logs for AIOpscited by 6
- 2024LLMcap: Large Language Model for Unsupervised PCAP Failure Detectioncited by 6
- 2024Large Language Models for Anomaly Detection in Computational Workflows: from Supervised Fine-Tuning to In-Context Learningcited by 6
- 2024Adapting Large Language Models to Log Analysis with Interpretable Domain Knowledgecited by 6
- 2025K4: Online Log Anomaly Detection Via Unsupervised Typicality Learningcited by 6
- 2021A Taxonomy of Anomalies in Log Datacited by 5
- 2024A Comparative Study on Large Language Models for Log Parsingcited by 5
- 2024CmdCaliper: A Semantic-Aware Command-Line Embedding Model and Dataset for Security Researchcited by 5
- 2024LogELECTRA: Self-supervised Anomaly Detection for Unstructured Logscited by 4
- 2024FastLogAD: Log Anomaly Detection with Mask-Guided Pseudo Anomaly Generation and Discriminationcited by 4
- 2025LumiMAS: A Comprehensive Framework for Real-Time Monitoring and Enhanced Observability in Multi-Agent Systemscited by 4
- 2022Feature Selection for Fault Detection and Prediction based on Event Log Analysiscited by 3
- 2023PULL: Reactive Log Anomaly Detection Based On Iterative PU Learningcited by 3
- 2023GLAD: Content-aware Dynamic Graphs For Log Anomaly Detectioncited by 3
- 2024MistralBSM: Leveraging Mistral-7B for Vehicular Networks Misbehavior Detectioncited by 3
- 2025Adapting Large Language Models for Parameter-Efficient Log Anomaly Detectioncited by 3
- 2025LogLLaMA: Transformer-based log anomaly detection with LLaMAcited by 3
- 2025From Texts to Shields: Convergence of Large Language Models and Cybersecuritycited by 3
- 2025Evaluating Language Models For Threat Detection in IoT Security Logscited by 3
- 2022Fine-grained Anomaly Detection in Sequential Data via Counterfactual Explanationscited by 2
- 2023Anomaly Detection of Command Shell Sessions based on DistilBERT: Unsupervised and Supervised Approachescited by 2
- 2024LUK: Empowering Log Understanding with Expert Knowledge from Large Language Modelscited by 2
- 2024Oddballness: universal anomaly detection with language modelscited by 2
- 2025Deep Learning-based Intrusion Detection Systems: A Surveycited by 2
- 2025RuleGenie: SIEM Detection Rule Set Optimizationcited by 2
- 2025LogTinyLLM: Tiny Large Language Models Based Contextual Log Anomaly Detectioncited by 2
- 2025Self-Supervised Learning of Graph Representations for Network Intrusion Detectioncited by 2
50 most cited of 114 All 114 (JSON)
- 2026ETH-TraceBench: A Large-Scale Event-Stream Benchmark for Ethereum DeFi under Temporal, Protocol, and Contract Shift20 Sep 2026
- 2026SENTINEL: A Multi-Pathway Architecture for Detecting Living-Off-the-Land APT Attacks on Windows Command Lines13 Sep 2026
- 2026RankShift: In-Database Detection and Explanation of Categorical Shifts28 Aug 2026
- 2026How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection2 Aug 2026
- 2026Exploring Block Anomaly Detection In HDFS Log Data Analysis31 Jul 2026
- 2026Beyond Heavy Log Curation: Perplexity-Based APT Detection via Unsupervised, Context-Augmented Language Models23 Jul 2026
- 2026Robust Conformal Intrusion Detection via Traffic-Aware Calibration and Attack-Orbit Invariance22 Jul 2026
- 2026Continuous Behavioral Authentication via Multi-Expert BERT Log Analysis for Secure Data Sharing20 Jun 2026
- 2026TGCM: Topic-Guided Consistency Modeling for One-Step Disentanglement of Interleaved APT Technique Sequences17 Jun 2026
- 2026SDVDiag: Multimodal Causal Discovery for Online Diagnosis in Software-defined Vehicles14 Jun 2026
- 2026Abstracting Cross-Domain Action Sequences into Interpretable Workflows12 Jun 2026
- 2026Benchmarking and Exploring the Capabilities of LLMs for Attack Investigations9 Jun 2026
38 more
- 2026LogNEO: A GPT-Neo Reinforcement Learning Framework for Accurate Real-Time Log Anomaly Detection6 Jun 2026
- 2026NLLog: Lightweight, Explainable SOC Anomaly Detection via Log-to-Language Rewriting3 Jun 2026
- 2026UModel: An Agent-Ready Observability Data Modeling Method at Scale3 Jun 2026
- 2026TrajAudit: Automated Failure Diagnosis for Agentic Coding Systems26 May 2026
- 2026FAME: Failure-Aware Mixture-of-Experts for Message-Level Log Anomaly Detection21 May 2026
- 2026LogRouter: Adaptive Two-Level LLM Routing for Log Question Answering in Big Data Systems18 May 2026
- 2026Seeing the Needle in the Haystack: Towards Weakly-Supervised Log Instance Anomaly Localization via Counterfactual Perturbation9 May 2026
- 2026TraXion: Rethinking Pre-training Frameworks for Mobility and Beyond7 May 2026
- 2026PrefixGuard: From LLM-Agent Traces to Online Failure-Warning Monitors7 May 2026
- 2026DP-FlogTinyLLM: Differentially private federated log anomaly detection using Tiny LLMs21 Apr 2026
- 2026CLAD: Efficient Log Anomaly Detection Directly on Compressed Representations14 Apr 2026
- 2026LLM-Enhanced Log Anomaly Detection: A Comprehensive Benchmark of Large Language Models for Automated System Diagnostics14 Apr 2026
- 2026Instruction-Tuned LLMs for Parsing and Mining Unstructured Logs on Leadership HPC Systems6 Apr 2026
- 2026AOI: Turning Failed Trajectories into Training Signals for Autonomous Cloud Diagnosis3 Mar 2026
- 2026On Sequence-to-Sequence Models for Automated Log Parsing7 Feb 2026
- 2026KRONE: Scalable LLM-Augmented Log Anomaly Detection via Hierarchical Abstraction7 Feb 2026
- 2026Next-generation cyberattack detection with large language models: anomaly analysis across heterogeneous logs6 Feb 2026
- 2026ContraLog: Log File Anomaly Detection with Contrastive Learning and Masked Language Modeling3 Feb 2026
- 2026Log anomaly detection via Meta Learning and Prototypical Networks for Cross domain generalization20 Jan 2026
- 2025Debugging Tabular Log as Dynamic Graphs28 Dec 2025
- 2025FedLAD: A Modular and Adaptive Testbed for Federated Log Anomaly Detection9 Dec 2025
- 2025MINES: Explainable Anomaly Detection through Web API Invariant Inference7 Dec 2025
- 2025ICAD-LLM: One-for-All Anomaly Detection via In-Context Learning with Large Language Models1 Dec 2025
- 2025Automated Fault Detection in 5G Core Networks Using Large Language Models24 Nov 2025
- 2025A Problem-Oriented Taxonomy of Evaluation Metrics for Time Series Anomaly Detection24 Nov 2025
- 2025LogPurge: Log Data Purification for Anomaly Detection via Rule-Enhanced Filtering18 Nov 2025
- 2025A Novel GPT-Based Framework for Anomaly Detection in System Logs16 Oct 2025
- 2025Self-Supervised Learning of Graph Representations for Network Intrusion Detection20 Sep 2025
- 2025Large Language Models for Security Operations Centers: A Comprehensive Survey13 Sep 2025
- 2025ALPHA: LLM-Enabled Active Learning for Human-Free Network Anomaly Detection7 Sep 2025
- 2025LumiMAS: A Comprehensive Framework for Real-Time Monitoring and Enhanced Observability in Multi-Agent Systems17 Aug 2025
- 2025MambaITD: An Efficient Cross-Modal Mamba Network for Insider Threat Detection6 Aug 2025
- 2025Leveraging large language models for SQL behavior-based database intrusion detection6 Aug 2025
- 2025Towards Generalizable Context-aware Anomaly Detection: A Large-scale Benchmark in Cloud Environments3 Aug 2025
- 2025K4: Online Log Anomaly Detection Via Unsupervised Typicality Learning26 Jul 2025
- 2025LogTinyLLM: Tiny Large Language Models Based Contextual Log Anomaly Detection15 Jul 2025
- 2025Evaluating Language Models For Threat Detection in IoT Security Logs3 Jul 2025
- 2025Good Enough to Learn: LLM-based Anomaly Detection in ECU Logs without Reliable Labels1 Jul 2025
50 newest of 114 All 114 (JSON)
- 2023RCAgent: Cloud Root Cause Analysis by Autonomous Agents with Tool-Augmented Large Language Modelscited by 62
- 2024mABC: multi-Agent Blockchain-Inspired Collaboration for root cause analysis in micro-services architecturecited by 26
- 2026TrajAudit: Automated Failure Diagnosis for Agentic Coding Systemscited by 11
- 2025LumiMAS: A Comprehensive Framework for Real-Time Monitoring and Enhanced Observability in Multi-Agent Systemscited by 4
- 2026PrefixGuard: From LLM-Agent Traces to Online Failure-Warning Monitorscited by 1
- 2026UModel: An Agent-Ready Observability Data Modeling Method at Scalecited by 1
- 2026UModel: An Agent-Ready Observability Data Modeling Method at Scale3 Jun 2026
- 2026TrajAudit: Automated Failure Diagnosis for Agentic Coding Systems26 May 2026
- 2026PrefixGuard: From LLM-Agent Traces to Online Failure-Warning Monitors7 May 2026
- 2025LumiMAS: A Comprehensive Framework for Real-Time Monitoring and Enhanced Observability in Multi-Agent Systems17 Aug 2025
- 2024mABC: multi-Agent Blockchain-Inspired Collaboration for root cause analysis in micro-services architecture18 Apr 2024
- 2023RCAgent: Cloud Root Cause Analysis by Autonomous Agents with Tool-Augmented Large Language Models25 Oct 2023
- 2021Log-based Anomaly Detection Without Log Parsingcited by 59
- 2022Log-based Anomaly Detection with Deep Learning: How Far Are We?cited by 56
- 2021LAnoBERT: System Log Anomaly Detection based on BERT Masked Language Modelcited by 30
- 2022Deep Learning for Anomaly Detection in Log Data: A Surveycited by 27
- 2023LogGPT: Log Anomaly Detection via GPTcited by 26
- 2024Transformers and Large Language Models for Efficient Intrusion Detection Systems: A Comprehensive Surveycited by 21
- 2024LogLLM: Log-based Anomaly Detection Using Large Language Modelscited by 21
- 2022Tele-Knowledge Pre-training for Fault Analysiscited by 18
- 2022CAN-BERT do it? Controller Area Network Intrusion Detection System based on BERT Language Modelcited by 17
- 2023AI for IT Operations (AIOps) on Cloud Platforms: Reviews, Opportunities and Challengescited by 13
- 2022MAD: Self-Supervised Masked Anomaly Detection Task for Multivariate Time Seriescited by 12
- 2021UniLog: Deploy One Model and Specialize it for All Log Analysis Taskscited by 11
12 most cited of 103 All 103 (JSON)
- 2026ETH-TraceBench: A Large-Scale Event-Stream Benchmark for Ethereum DeFi under Temporal, Protocol, and Contract Shift20 Sep 2026
- 2026SENTINEL: A Multi-Pathway Architecture for Detecting Living-Off-the-Land APT Attacks on Windows Command Lines13 Sep 2026
- 2026RankShift: In-Database Detection and Explanation of Categorical Shifts28 Aug 2026
- 2026How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection2 Aug 2026
- 2026Exploring Block Anomaly Detection In HDFS Log Data Analysis31 Jul 2026
- 2026Beyond Heavy Log Curation: Perplexity-Based APT Detection via Unsupervised, Context-Augmented Language Models23 Jul 2026
- 2026Robust Conformal Intrusion Detection via Traffic-Aware Calibration and Attack-Orbit Invariance22 Jul 2026
- 2026Continuous Behavioral Authentication via Multi-Expert BERT Log Analysis for Secure Data Sharing20 Jun 2026
- 2026SDVDiag: Multimodal Causal Discovery for Online Diagnosis in Software-defined Vehicles14 Jun 2026
- 2026Abstracting Cross-Domain Action Sequences into Interpretable Workflows12 Jun 2026
- 2026Benchmarking and Exploring the Capabilities of LLMs for Attack Investigations9 Jun 2026
- 2026LogNEO: A GPT-Neo Reinforcement Learning Framework for Accurate Real-Time Log Anomaly Detection6 Jun 2026
12 newest of 103 All 103 (JSON)