# A2Log: Attentive Augmented Log Anomaly Detection

arXiv: https://arxiv.org/abs/2109.09537 · HTML: https://mlsanity.com/paper/2109.09537/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- Builds on 10 of its 40 references that are in the map.
- First posted on arXiv 20 Sep 2021.

## Builds on (most cited first, 10 of 10)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [Convolutional Sequence to Sequence Learning](https://mlsanity.com/paper/1705.03122/) (2017)
- [Neural Unsupervised Domain Adaptation in NLP---A Survey](https://mlsanity.com/paper/2006.00632/) (2020)
- [LogBERT: Log Anomaly Detection via BERT](https://mlsanity.com/paper/2103.04475/) (2021)
- [Small Data Challenges in Big Data Era: A Survey of Recent Progress on Unsupervised and Semi-Supervised Methods](https://mlsanity.com/paper/1903.11260/) (2019)
- [Self-Attentive Classification-Based Anomaly Detection in Unstructured Logs](https://mlsanity.com/paper/2008.09340/) (2020)
- [Self-Supervised Log Parsing](https://mlsanity.com/paper/2003.07905/) (2020)
- [Recurrent Neural Network Attention Mechanisms for Interpretable System Log Anomaly Detection](https://mlsanity.com/paper/1803.04967/) (2018)
- [Decentralized Federated Learning Preserves Model and Data Privacy](https://mlsanity.com/paper/2102.00880/) (2021)

## Built on by (most cited first, 10 of 10)

- [Deep Learning for Anomaly Detection in Log Data: A Survey](https://mlsanity.com/paper/2207.03820/) (2022)
- [LogLG: Weakly Supervised Log Anomaly Detection via Log-Event Graph Construction](https://mlsanity.com/paper/2208.10833/) (2022)
- [TransLog: A Unified Transformer-based Framework for Log Anomaly Detection](https://mlsanity.com/paper/2201.00016/) (2021)
- [LogLAB: Attention-Based Labeling of Log Data Anomalies via Weak Supervision](https://mlsanity.com/paper/2111.01657/) (2021)
- [A Taxonomy of Anomalies in Log Data](https://mlsanity.com/paper/2111.13462/) (2021)
- [FastLogAD: Log Anomaly Detection with Mask-Guided Pseudo Anomaly Generation and Discrimination](https://mlsanity.com/paper/2404.08750/) (2024)
- [PULL: Reactive Log Anomaly Detection Based On Iterative PU Learning](https://mlsanity.com/paper/2301.10681/) (2023)
- [Progressing from Anomaly Detection to Automated Log Labeling and Pioneering Root Cause Analysis](https://mlsanity.com/paper/2312.14748/) (2023)
- [Unsupervised Threat Hunting using Continuous Bag-of-Terms-and-Time (CBoTT)](https://mlsanity.com/paper/2403.10327/) (2024)
- [A unified framework for detecting point and collective anomalies in operating system logs via collaborative transformers](https://mlsanity.com/paper/2512.23380/) (2025)

## Abstract (arXiv)

Anomaly detection becomes increasingly important for the dependability and serviceability of IT services. As log lines record events during the execution of IT services, they are a primary source for diagnostics. Thereby, unsupervised methods provide a significant benefit since not all anomalies can be known at training time. Existing unsupervised methods need anomaly examples to obtain a suitable decision boundary required for the anomaly detection task. This requirement poses practical limitations. Therefore, we develop A2Log, which is an unsupervised anomaly detection method consisting of two steps: Anomaly scoring and anomaly decision. First, we utilize a self-attention neural network to perform the scoring for each log message. Second, we set the decision boundary based on data augmentation of the available normal training data. The method is evaluated on three publicly available datasets and one industry dataset. We show that our approach outperforms existing methods. Furthermore, we utilize available anomaly examples to set optimal decision boundaries to acquire strong baselines. We show that our approach, which determines decision boundaries without utilizing anomaly examples, can reach scores of the strong baselines.