Log-based Anomaly Detection Without Log Parsing
Not on the map. Why?
Abstract (arXiv)
Software systems often record important runtime information in system logs for troubleshooting purposes. There have been many studies that use log data to construct machine learning models for detecting system anomalies. Through our empirical study, we find that existing log-based anomaly detection approaches are significantly affected by log parsing errors that are introduced by 1) OOV (out-of-vocabulary) words, and 2) semantic misunderstandings. The log parsing errors could cause the loss of important information for anomaly detection. To address the limitations of existing methods, we propose NeuralLog, a novel log-based anomaly detection approach that does not require log parsing. NeuralLog extracts the semantic meaning of raw log messages and represents them as semantic vectors. These representation vectors are then used to detect anomalies through a Transformer-based classification model, which can capture the contextual information from log sequences. Our experimental results show that the proposed approach can effectively understand the semantic meaning of log messages and achieve accurate anomaly detection results. Overall, NeuralLog achieves F1-scores greater than 0.95 on four public datasets, outperforming the existing approaches.
Key facts. Cited by 59 papers in the map (data through 7 Oct 2026). Builds on 16 of its 58 references that are in the map. First posted on arXiv 4 Aug 2021.
Builds on
16 of 58 references.
References · 16
- 2017Attention Is All You Needcited by 59,932
- 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
- 2013Efficient Estimation of Word Representations in Vector Spacecited by 4,346
- 2019DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lightercited by 4,243
- 2019Unsupervised Cross-lingual Representation Learning at Scalecited by 3,907
- 2016Google's Neural Machine Translation System: Bridging the Gap between Human and Machine Translationcited by 1,471
- 2014Distributed Representations of Sentences and Documentscited by 677
- 2016FastText.zip: Compressing text classification modelscited by 331
- 2021LogBERT: Log Anomaly Detection via BERTcited by 114
- 2018Tools and Benchmarks for Automated Log Parsingcited by 56
- 2020Big Code != Big Vocabulary: Open-Vocabulary Models for Source Codecited by 53
- 2020Self-Attentive Classification-Based Anomaly Detection in Unstructured Logscited by 36
4 more
- 2017Mimicking Word Embeddings using Subword RNNscited by 30
- 2019Few-Shot Representation Learning for Out-Of-Vocabulary Wordscited by 30
- 2018Generalizing Word Embeddings using Bag of Subwordscited by 9
- 2020Logram: Efficient Log Parsing Using n-Gram Dictionariescited by 9
Built on by
Citing papers per year: 2021: 3; 2022: 7; 2023: 15; 2024: 13; 2025: 11; 2026: 10.
59 papers.
Sort:
By area:
- 2022Log-based Anomaly Detection with Deep Learning: How Far Are We?cited by 56
- 2023Interpretable Online Log Analysis Using Large Language Models with Prompt Strategiescited by 34
- 2021LAnoBERT: System Log Anomaly Detection based on BERT Masked Language Modelcited by 30
- 2022Deep Learning for Anomaly Detection in Log Data: A Surveycited by 27
- 2024LogLLM: Log-based Anomaly Detection Using Large Language Modelscited by 21
- 2023RAGLog: Log Anomaly Detection using Retrieval Augmented Generationcited by 19
- 2022Tele-Knowledge Pre-training for Fault Analysiscited by 18
- 2025A Survey of AIOps in the Era of Large Language Modelscited by 18
- 2022CAN-BERT do it? Controller Area Network Intrusion Detection System based on BERT Language Modelcited by 17
- 2024Face It Yourselves: An LLM-Based Two-Stage Strategy to Localize Configuration Errors via Logscited by 17
- 2023Log Parsing: How Far Can ChatGPT Go?cited by 16
- 2023AI for IT Operations (AIOps) on Cloud Platforms: Reviews, Opportunities and Challengescited by 13
38 more
- 2024LogLM: From Task-based to Instruction-based Automated Log Analysiscited by 13
- 2023An Assessment of ChatGPT on Log Datacited by 11
- 2024LogEval: A Comprehensive Benchmark Suite for Large Language Models In Log Analysiscited by 10
- 2025Large Language Models for Security Operations Centers: A Comprehensive Surveycited by 9
- 2022LogLG: Weakly Supervised Log Anomaly Detection via Log-Event Graph Constructioncited by 8
- 2022LogGD:Detecting Anomalies from System Logs by Graph Neural Networkscited by 8
- 2023Heterogeneous Anomaly Detection for Software Systems via Semi-supervised Cross-modal Attentioncited by 8
- 2021TransLog: A Unified Transformer-based Framework for Log Anomaly Detectioncited by 7
- 2021A Comprehensive Survey of Logging in Software: From Logging Statements Automation to Log Mining and Analysiscited by 6
- 2023On the Effectiveness of Log Representation for Log-based Anomaly Detectioncited by 6
- 2023Learning Representations on Logs for AIOpscited by 6
- 2023Twin Graph-based Anomaly Detection via Attentive Multi-Modal Learning for Microservice Systemcited by 6
- 2024Demystifying and Extracting Fault-indicating Information from Logs for Failure Diagnosiscited by 6
- 2024Adapting Large Language Models to Log Analysis with Interpretable Domain Knowledgecited by 6
- 2024FastLogAD: Log Anomaly Detection with Mask-Guided Pseudo Anomaly Generation and Discriminationcited by 4
- 2025AdaptiveLog: An Adaptive Log Analysis Framework with the Collaboration of Large and Small Language Modelcited by 4
- 2023Log-based Anomaly Detection based on EVT Theory with feedbackcited by 3
- 2024AI for DevSecOps: A Landscape and Future Opportunitiescited by 3
- 2023Anomaly Detection of Command Shell Sessions based on DistilBERT: Unsupervised and Supervised Approachescited by 2
- 2024Cross-System Categorization of Abnormal Traces in Microservice-Based Systems via Meta-Learningcited by 2
- 2024A Scenario-Oriented Benchmark for Assessing AIOps Algorithms in Microservice Managementcited by 2
- 2024LUK: Empowering Log Understanding with Expert Knowledge from Large Language Modelscited by 2
- 2025Deep Learning-based Intrusion Detection Systems: A Surveycited by 2
- 2025Hypergraph-Guided Regex Filter Synthesis for Event-Based Anomaly Detectioncited by 2
- 2023Try with Simpler -- An Evaluation of Improved Principal Component Analysis in Log-based Anomaly Detectioncited by 1
- 2023LogLead -- Fast and Integrated Log Loader, Enhancer, and Anomaly Detectorcited by 1
- 2024Enhancing Reasoning Capacity of SLM using Cognitive Enhancementcited by 1
- 2025From Few-Label to Zero-Label: An Approach for Cross-System Log-Based Anomaly Detection with Meta-Learningcited by 1
- 2025ALPHA: LLM-Enabled Active Learning for Human-Free Network Anomaly Detectioncited by 1
- 2025FedLAD: A Modular and Adaptive Testbed for Federated Log Anomaly Detectioncited by 1
- 2026LLM-Enhanced Log Anomaly Detection: A Comprehensive Benchmark of Large Language Models for Automated System Diagnosticscited by 1
- 2026EventADL: Open-Box Anomaly Detection and Localization Framework for Events in Cloud-Based Service Systemscited by 1
- 2022AI based Log Analyser: A Practical Approachcited by 0
- 2023ClusterLog: Clustering Logs for Effective Log-based Anomaly Detectioncited by 0
- 2023RAPID: Training-free Retrieval-based Log Anomaly Detection with PLM considering Token-level informationcited by 0
- 2024What Information Contributes to Log-based Anomaly Detection? Insights from a Configurable Transformer-Based Approachcited by 0
- 2025A Comprehensive Forecasting-Based Framework for Time Series Anomaly Detection: Benchmarking on the Numenta Anomaly Benchmark (NAB)cited by 0
- 2025FusionLog: Cross-System Log-based Anomaly Detection via Fusion of General and Proprietary Knowledgecited by 0
50 most cited of 59 All 59 (JSON)
- 2026Too Sure to Be Safe: Model Calibration for Reliable Log Anomaly Detection18 Aug 2026
- 2026NLLog: Lightweight, Explainable SOC Anomaly Detection via Log-to-Language Rewriting3 Jun 2026
- 2026EventADL: Open-Box Anomaly Detection and Localization Framework for Events in Cloud-Based Service Systems1 May 2026
- 2026CLAD: Efficient Log Anomaly Detection Directly on Compressed Representations14 Apr 2026
- 2026LLM-Enhanced Log Anomaly Detection: A Comprehensive Benchmark of Large Language Models for Automated System Diagnostics14 Apr 2026
- 2026SCOPE: Tree-based Self-Correcting Online Log Parsing via Syntactic-Semantic Collaboration28 Mar 2026
- 2026CFD-HAR: User-controllable Privacy through Conditional Feature Disentanglement12 Mar 2026
- 2026KRONE: Scalable LLM-Augmented Log Anomaly Detection via Hierarchical Abstraction7 Feb 2026
- 2026ContraLog: Log File Anomaly Detection with Contrastive Learning and Masked Language Modeling3 Feb 2026
- 2026Log anomaly detection via Meta Learning and Prototypical Networks for Cross domain generalization20 Jan 2026
- 2025FedLAD: A Modular and Adaptive Testbed for Federated Log Anomaly Detection9 Dec 2025
- 2025MINES: Explainable Anomaly Detection through Web API Invariant Inference7 Dec 2025
38 more
- 2025FusionLog: Cross-System Log-based Anomaly Detection via Fusion of General and Proprietary Knowledge8 Nov 2025
- 2025A Comprehensive Forecasting-Based Framework for Time Series Anomaly Detection: Benchmarking on the Numenta Anomaly Benchmark (NAB)13 Oct 2025
- 2025Large Language Models for Security Operations Centers: A Comprehensive Survey13 Sep 2025
- 2025Hypergraph-Guided Regex Filter Synthesis for Event-Based Anomaly Detection8 Sep 2025
- 2025ALPHA: LLM-Enabled Active Learning for Human-Free Network Anomaly Detection7 Sep 2025
- 2025From Few-Label to Zero-Label: An Approach for Cross-System Log-Based Anomaly Detection with Meta-Learning26 Jul 2025
- 2025A Survey of AIOps in the Era of Large Language Models23 Jun 2025
- 2025Deep Learning-based Intrusion Detection Systems: A Survey10 Apr 2025
- 2025AdaptiveLog: An Adaptive Log Analysis Framework with the Collaboration of Large and Small Language Model19 Jan 2025
- 2024Adapting Large Language Models to Log Analysis with Interpretable Domain Knowledge2 Dec 2024
- 2024LogLLM: Log-based Anomaly Detection Using Large Language Models13 Nov 2024
- 2024LogLM: From Task-based to Instruction-based Automated Log Analysis12 Oct 2024
- 2024What Information Contributes to Log-based Anomaly Detection? Insights from a Configurable Transformer-Based Approach30 Sep 2024
- 2024Demystifying and Extracting Fault-indicating Information from Logs for Failure Diagnosis20 Sep 2024
- 2024LUK: Empowering Log Understanding with Expert Knowledge from Large Language Models3 Sep 2024
- 2024A Scenario-Oriented Benchmark for Assessing AIOps Algorithms in Microservice Management9 Jul 2024
- 2024LogEval: A Comprehensive Benchmark Suite for Large Language Models In Log Analysis2 Jul 2024
- 2024FastLogAD: Log Anomaly Detection with Mask-Guided Pseudo Anomaly Generation and Discrimination12 Apr 2024
- 2024AI for DevSecOps: A Landscape and Future Opportunities7 Apr 2024
- 2024Enhancing Reasoning Capacity of SLM using Cognitive Enhancement1 Apr 2024
- 2024Face It Yourselves: An LLM-Based Two-Stage Strategy to Localize Configuration Errors via Logs31 Mar 2024
- 2024Cross-System Categorization of Abnormal Traces in Microservice-Based Systems via Meta-Learning27 Mar 2024
- 2023LogLead -- Fast and Integrated Log Loader, Enhancer, and Anomaly Detector20 Nov 2023
- 2023RAGLog: Log Anomaly Detection using Retrieval Augmented Generation9 Nov 2023
- 2023RAPID: Training-free Retrieval-based Log Anomaly Detection with PLM considering Token-level information9 Nov 2023
- 2023Anomaly Detection of Command Shell Sessions based on DistilBERT: Unsupervised and Supervised Approaches20 Oct 2023
- 2023Twin Graph-based Anomaly Detection via Attentive Multi-Modal Learning for Microservice System7 Oct 2023
- 2023An Assessment of ChatGPT on Log Data14 Sep 2023
- 2023Try with Simpler -- An Evaluation of Improved Principal Component Analysis in Log-based Anomaly Detection24 Aug 2023
- 2023Learning Representations on Logs for AIOps18 Aug 2023
- 2023On the Effectiveness of Log Representation for Log-based Anomaly Detection17 Aug 2023
- 2023Interpretable Online Log Analysis Using Large Language Models with Prompt Strategies15 Aug 2023
- 2023Log-based Anomaly Detection based on EVT Theory with feedback8 Jun 2023
- 2023Log Parsing: How Far Can ChatGPT Go?2 Jun 2023
- 2023AI for IT Operations (AIOps) on Cloud Platforms: Reviews, Opportunities and Challenges10 Apr 2023
- 2023Heterogeneous Anomaly Detection for Software Systems via Semi-supervised Cross-modal Attention14 Feb 2023
- 2023ClusterLog: Clustering Logs for Effective Log-based Anomaly Detection19 Jan 2023
- 2022Tele-Knowledge Pre-training for Fault Analysis20 Oct 2022
50 newest of 59 All 59 (JSON)
- 2022Log-based Anomaly Detection with Deep Learning: How Far Are We?cited by 56
- 2023Interpretable Online Log Analysis Using Large Language Models with Prompt Strategiescited by 34
- 2021LAnoBERT: System Log Anomaly Detection based on BERT Masked Language Modelcited by 30
- 2022Deep Learning for Anomaly Detection in Log Data: A Surveycited by 27
- 2024LogLLM: Log-based Anomaly Detection Using Large Language Modelscited by 21
- 2022Tele-Knowledge Pre-training for Fault Analysiscited by 18
- 2025A Survey of AIOps in the Era of Large Language Modelscited by 18
- 2022CAN-BERT do it? Controller Area Network Intrusion Detection System based on BERT Language Modelcited by 17
- 2024Face It Yourselves: An LLM-Based Two-Stage Strategy to Localize Configuration Errors via Logscited by 17
- 2023Log Parsing: How Far Can ChatGPT Go?cited by 16
- 2023AI for IT Operations (AIOps) on Cloud Platforms: Reviews, Opportunities and Challengescited by 13
- 2024LogLM: From Task-based to Instruction-based Automated Log Analysiscited by 13
12 most cited of 57 All 57 (JSON)
- 2026Too Sure to Be Safe: Model Calibration for Reliable Log Anomaly Detection18 Aug 2026
- 2026NLLog: Lightweight, Explainable SOC Anomaly Detection via Log-to-Language Rewriting3 Jun 2026
- 2026EventADL: Open-Box Anomaly Detection and Localization Framework for Events in Cloud-Based Service Systems1 May 2026
- 2026CLAD: Efficient Log Anomaly Detection Directly on Compressed Representations14 Apr 2026
- 2026LLM-Enhanced Log Anomaly Detection: A Comprehensive Benchmark of Large Language Models for Automated System Diagnostics14 Apr 2026
- 2026SCOPE: Tree-based Self-Correcting Online Log Parsing via Syntactic-Semantic Collaboration28 Mar 2026
- 2026CFD-HAR: User-controllable Privacy through Conditional Feature Disentanglement12 Mar 2026
- 2026KRONE: Scalable LLM-Augmented Log Anomaly Detection via Hierarchical Abstraction7 Feb 2026
- 2026ContraLog: Log File Anomaly Detection with Contrastive Learning and Masked Language Modeling3 Feb 2026
- 2026Log anomaly detection via Meta Learning and Prototypical Networks for Cross domain generalization20 Jan 2026
- 2025FedLAD: A Modular and Adaptive Testbed for Federated Log Anomaly Detection9 Dec 2025
- 2025MINES: Explainable Anomaly Detection through Web API Invariant Inference7 Dec 2025
12 newest of 57 All 57 (JSON)