# A Taxonomy of Anomalies in Log Data

arXiv: https://arxiv.org/abs/2111.13462 · HTML: https://mlsanity.com/paper/2111.13462/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 27 references that are in the map.
- First posted on arXiv 26 Nov 2021.

## Builds on (most cited first, 7 of 7)

- [Deep Learning for Anomaly Detection: A Survey](https://mlsanity.com/paper/1901.03407/) (2019)
- [A review on outlier/anomaly detection in time series data](https://mlsanity.com/paper/2002.04236/) (2020)
- [LogBERT: Log Anomaly Detection via BERT](https://mlsanity.com/paper/2103.04475/) (2021)
- [A Survey on Automated Log Analysis for Reliability Engineering](https://mlsanity.com/paper/2009.07237/) (2020)
- [Self-Supervised Log Parsing](https://mlsanity.com/paper/2003.07905/) (2020)
- [A2Log: Attentive Augmented Log Anomaly Detection](https://mlsanity.com/paper/2109.09537/) (2021)
- [LogLAB: Attention-Based Labeling of Log Data Anomalies via Weak Supervision](https://mlsanity.com/paper/2111.01657/) (2021)

## Built on by (most cited first, 5 of 5)

- [LogELECTRA: Self-supervised Anomaly Detection for Unstructured Logs](https://mlsanity.com/paper/2402.10397/) (2024)
- [We Need to Rethink Benchmarking in Anomaly Detection](https://mlsanity.com/paper/2507.15584/) (2025)
- [PULL: Reactive Log Anomaly Detection Based On Iterative PU Learning](https://mlsanity.com/paper/2301.10681/) (2023)
- [Progressing from Anomaly Detection to Automated Log Labeling and Pioneering Root Cause Analysis](https://mlsanity.com/paper/2312.14748/) (2023)
- [ContraLog: Log File Anomaly Detection with Contrastive Learning and Masked Language Modeling](https://mlsanity.com/paper/2602.03678/) (2026)

## Abstract (arXiv)

Log data anomaly detection is a core component in the area of artificial intelligence for IT operations. However, the large amount of existing methods makes it hard to choose the right approach for a specific system. A better understanding of different kinds of anomalies, and which algorithms are suitable for detecting them, would support researchers and IT operators. Although a common taxonomy for anomalies already exists, it has not yet been applied specifically to log data, pointing out the characteristics and peculiarities in this domain. In this paper, we present a taxonomy for different kinds of log data anomalies and introduce a method for analyzing such anomalies in labeled datasets. We applied our taxonomy to the three common benchmark datasets Thunderbird, Spirit, and BGL, and trained five state-of-the-art unsupervised anomaly detection algorithms to evaluate their performance in detecting different kinds of anomalies. Our results show, that the most common anomaly type is also the easiest to predict. Moreover, deep learning-based approaches outperform data mining-based approaches in all anomaly types, but especially when it comes to detecting contextual anomalies.