Log-based Anomaly Detection with Deep Learning: How Far Are We?
Not on the map. Why?
Abstract (arXiv)
Software-intensive systems produce logs for troubleshooting purposes. Recently, many deep learning models have been proposed to automatically detect system anomalies based on log data. These models typically claim very high detection accuracy. For example, most models report an F-measure greater than 0.9 on the commonly-used HDFS dataset. To achieve a profound understanding of how far we are from solving the problem of log-based anomaly detection, in this paper, we conduct an in-depth analysis of five state-of-the-art deep learning-based models for detecting system anomalies on four public log datasets. Our experiments focus on several aspects of model evaluation, including training data selection, data grouping, class distribution, data noise, and early detection ability. Our results point out that all these aspects have significant impact on the evaluation, and that all the studied models do not always work well. The problem of log-based anomaly detection has not been solved yet. Based on our findings, we also suggest possible future work.
Key facts. Cited by 56 papers in the map (data through 7 Oct 2026). Builds on 11 of its 51 references that are in the map. First posted on arXiv 9 Feb 2022.
Builds on
11 of 51 references.
References · 11
- 2017Attention Is All You Needcited by 59,932
- 2014Learning Phrase Representations using RNN Encoder-Decoder for Statistical Machine Translationcited by 4,016
- 2014Convolutional Neural Networks for Sentence Classificationcited by 1,124
- 2016FastText.zip: Compressing text classification modelscited by 331
- 2021LogBERT: Log Anomaly Detection via BERTcited by 114
- 2021Log-based Anomaly Detection Without Log Parsingcited by 59
- 2018Tools and Benchmarks for Automated Log Parsingcited by 56
- 2020A Survey on Automated Log Analysis for Reliability Engineeringcited by 50
- 2021Experience Report: Deep Learning-based System Log Analysis for Anomaly Detectioncited by 37
- 2020Self-Attentive Classification-Based Anomaly Detection in Unstructured Logscited by 36
- 2020Logram: Efficient Log Parsing Using n-Gram Dictionariescited by 9
Built on by
Citing papers per year: 2022: 5; 2023: 18; 2024: 11; 2025: 12; 2026: 10.
56 papers.
Sort:
By area:
- 2023RCAgent: Cloud Root Cause Analysis by Autonomous Agents with Tool-Augmented Large Language Modelscited by 62
- 2023Interpretable Online Log Analysis Using Large Language Models with Prompt Strategiescited by 34
- 2023LogGPT: Exploring ChatGPT for Log-Based Anomaly Detectioncited by 33
- 2022Deep Learning for Anomaly Detection in Log Data: A Surveycited by 27
- 2023LogGPT: Log Anomaly Detection via GPTcited by 26
- 2024LogLLM: Log-based Anomaly Detection Using Large Language Modelscited by 21
- 2022Tele-Knowledge Pre-training for Fault Analysiscited by 18
- 2023Log Parsing: How Far Can ChatGPT Go?cited by 16
- 2023AI for IT Operations (AIOps) on Cloud Platforms: Reviews, Opportunities and Challengescited by 13
- 2024LogLM: From Task-based to Instruction-based Automated Log Analysiscited by 13
- 2022LogGD:Detecting Anomalies from System Logs by Graph Neural Networkscited by 8
- 2023Graph Neural Networks based Log Anomaly Detection and Explanationcited by 8
38 more
- 2023A Critical Review of Common Log Data Sets Used for Evaluation of Sequence-based Anomaly Detection Techniquescited by 7
- 2024Reducing Events to Augment Log-based Anomaly Detection Models: An Empirical Studycited by 7
- 2023On the Effectiveness of Log Representation for Log-based Anomaly Detectioncited by 6
- 2023Twin Graph-based Anomaly Detection via Attentive Multi-Modal Learning for Microservice Systemcited by 6
- 2024Demystifying and Extracting Fault-indicating Information from Logs for Failure Diagnosiscited by 6
- 2025K4: Online Log Anomaly Detection Via Unsupervised Typicality Learningcited by 6
- 2024A Comparative Study on Large Language Models for Log Parsingcited by 5
- 2024LogELECTRA: Self-supervised Anomaly Detection for Unstructured Logscited by 4
- 2025AdaptiveLog: An Adaptive Log Analysis Framework with the Collaboration of Large and Small Language Modelcited by 4
- 2022Feature Selection for Fault Detection and Prediction based on Event Log Analysiscited by 3
- 2023Log-based Anomaly Detection based on EVT Theory with feedbackcited by 3
- 2023A Comprehensive Study of Machine Learning Techniques for Log-Based Anomaly Detectioncited by 3
- 2025Adapting Large Language Models for Parameter-Efficient Log Anomaly Detectioncited by 3
- 2023LogAI: A Library for Log Analytics and Intelligencecited by 2
- 2023Anomaly Detection of Command Shell Sessions based on DistilBERT: Unsupervised and Supervised Approachescited by 2
- 2024HELP: Hierarchical Embeddings-based Log Parsingcited by 2
- 2024LUK: Empowering Log Understanding with Expert Knowledge from Large Language Modelscited by 2
- 2025Data and System Perspectives of Sustainable Artificial Intelligencecited by 2
- 2025Hypergraph-Guided Regex Filter Synthesis for Event-Based Anomaly Detectioncited by 2
- 2023Try with Simpler -- An Evaluation of Improved Principal Component Analysis in Log-based Anomaly Detectioncited by 1
- 2023Log-based Anomaly Detection of Enterprise Software: An Empirical Studycited by 1
- 2025ADALog: Adaptive Unsupervised Anomaly detection in Logs with Self-attention Masked Language Modelcited by 1
- 2025A Novel GPT-Based Framework for Anomaly Detection in System Logscited by 1
- 2025FedLAD: A Modular and Adaptive Testbed for Federated Log Anomaly Detectioncited by 1
- 2026LLM-Enhanced Log Anomaly Detection: A Comprehensive Benchmark of Large Language Models for Automated System Diagnosticscited by 1
- 2022syslrn: Learning What to Monitor for Efficient Anomaly Detectioncited by 0
- 2023CSCLog: A Component Subsequence Correlation-Aware Log Anomaly Detection Methodcited by 0
- 2023RAPID: Training-free Retrieval-based Log Anomaly Detection with PLM considering Token-level informationcited by 0
- 2024Semi-supervised learning via DQN for log anomaly detectioncited by 0
- 2024MLAD: A Unified Model for Multi-system Log Anomaly Detectioncited by 0
- 2024What Information Contributes to Log-based Anomaly Detection? Insights from a Configurable Transformer-Based Approachcited by 0
- 2025Beyond Window-Based Detection: A Graph-Centric Framework for Discrete Log Anomaly Detectioncited by 0
- 2025RationAnomaly: Log Anomaly Detection with Rationality via Chain-of-Thought and Reinforcement Learningcited by 0
- 2025LogPurge: Log Data Purification for Anomaly Detection via Rule-Enhanced Filteringcited by 0
- 2025A unified framework for detecting point and collective anomalies in operating system logs via collaborative transformerscited by 0
- 2026Log anomaly detection via Meta Learning and Prototypical Networks for Cross domain generalizationcited by 0
- 2026ContraLog: Log File Anomaly Detection with Contrastive Learning and Masked Language Modelingcited by 0
- 2026KRONE: Scalable LLM-Augmented Log Anomaly Detection via Hierarchical Abstractioncited by 0
50 most cited of 56 All 56 (JSON)
- 2026Resilient Concurrent Causal Discovery for Topological Event Sequences22 Aug 2026
- 2026Too Sure to Be Safe: Model Calibration for Reliable Log Anomaly Detection18 Aug 2026
- 2026Sample-Efficient LLM-Based Detection of Malicious Web Server Logs with Forensically Explainable Reasoning7 Jun 2026
- 2026NLLog: Lightweight, Explainable SOC Anomaly Detection via Log-to-Language Rewriting3 Jun 2026
- 2026FAME: Failure-Aware Mixture-of-Experts for Message-Level Log Anomaly Detection21 May 2026
- 2026LLM-Enhanced Log Anomaly Detection: A Comprehensive Benchmark of Large Language Models for Automated System Diagnostics14 Apr 2026
- 2026SCOPE: Tree-based Self-Correcting Online Log Parsing via Syntactic-Semantic Collaboration28 Mar 2026
- 2026KRONE: Scalable LLM-Augmented Log Anomaly Detection via Hierarchical Abstraction7 Feb 2026
- 2026ContraLog: Log File Anomaly Detection with Contrastive Learning and Masked Language Modeling3 Feb 2026
- 2026Log anomaly detection via Meta Learning and Prototypical Networks for Cross domain generalization20 Jan 2026
- 2025A unified framework for detecting point and collective anomalies in operating system logs via collaborative transformers29 Dec 2025
- 2025FedLAD: A Modular and Adaptive Testbed for Federated Log Anomaly Detection9 Dec 2025
38 more
- 2025LogPurge: Log Data Purification for Anomaly Detection via Rule-Enhanced Filtering18 Nov 2025
- 2025A Novel GPT-Based Framework for Anomaly Detection in System Logs16 Oct 2025
- 2025RationAnomaly: Log Anomaly Detection with Rationality via Chain-of-Thought and Reinforcement Learning18 Sep 2025
- 2025Hypergraph-Guided Regex Filter Synthesis for Event-Based Anomaly Detection8 Sep 2025
- 2025K4: Online Log Anomaly Detection Via Unsupervised Typicality Learning26 Jul 2025
- 2025ADALog: Adaptive Unsupervised Anomaly detection in Logs with Self-attention Masked Language Model15 May 2025
- 2025Adapting Large Language Models for Parameter-Efficient Log Anomaly Detection11 Mar 2025
- 2025Beyond Window-Based Detection: A Graph-Centric Framework for Discrete Log Anomaly Detection21 Jan 2025
- 2025AdaptiveLog: An Adaptive Log Analysis Framework with the Collaboration of Large and Small Language Model19 Jan 2025
- 2025Data and System Perspectives of Sustainable Artificial Intelligence13 Jan 2025
- 2024LogLLM: Log-based Anomaly Detection Using Large Language Models13 Nov 2024
- 2024LogLM: From Task-based to Instruction-based Automated Log Analysis12 Oct 2024
- 2024What Information Contributes to Log-based Anomaly Detection? Insights from a Configurable Transformer-Based Approach30 Sep 2024
- 2024Demystifying and Extracting Fault-indicating Information from Logs for Failure Diagnosis20 Sep 2024
- 2024Reducing Events to Augment Log-based Anomaly Detection Models: An Empirical Study7 Sep 2024
- 2024A Comparative Study on Large Language Models for Log Parsing4 Sep 2024
- 2024LUK: Empowering Log Understanding with Expert Knowledge from Large Language Models3 Sep 2024
- 2024HELP: Hierarchical Embeddings-based Log Parsing15 Aug 2024
- 2024LogELECTRA: Self-supervised Anomaly Detection for Unstructured Logs16 Feb 2024
- 2024MLAD: A Unified Model for Multi-system Log Anomaly Detection15 Jan 2024
- 2024Semi-supervised learning via DQN for log anomaly detection6 Jan 2024
- 2023RAPID: Training-free Retrieval-based Log Anomaly Detection with PLM considering Token-level information9 Nov 2023
- 2023Log-based Anomaly Detection of Enterprise Software: An Empirical Study31 Oct 2023
- 2023RCAgent: Cloud Root Cause Analysis by Autonomous Agents with Tool-Augmented Large Language Models25 Oct 2023
- 2023Anomaly Detection of Command Shell Sessions based on DistilBERT: Unsupervised and Supervised Approaches20 Oct 2023
- 2023Twin Graph-based Anomaly Detection via Attentive Multi-Modal Learning for Microservice System7 Oct 2023
- 2023LogGPT: Log Anomaly Detection via GPT25 Sep 2023
- 2023A Critical Review of Common Log Data Sets Used for Evaluation of Sequence-based Anomaly Detection Techniques6 Sep 2023
- 2023LogGPT: Exploring ChatGPT for Log-Based Anomaly Detection3 Sep 2023
- 2023Try with Simpler -- An Evaluation of Improved Principal Component Analysis in Log-based Anomaly Detection24 Aug 2023
- 2023On the Effectiveness of Log Representation for Log-based Anomaly Detection17 Aug 2023
- 2023Interpretable Online Log Analysis Using Large Language Models with Prompt Strategies15 Aug 2023
- 2023A Comprehensive Study of Machine Learning Techniques for Log-Based Anomaly Detection31 Jul 2023
- 2023CSCLog: A Component Subsequence Correlation-Aware Log Anomaly Detection Method7 Jul 2023
- 2023Graph Neural Networks based Log Anomaly Detection and Explanation2 Jul 2023
- 2023Log-based Anomaly Detection based on EVT Theory with feedback8 Jun 2023
- 2023Log Parsing: How Far Can ChatGPT Go?2 Jun 2023
- 2023AI for IT Operations (AIOps) on Cloud Platforms: Reviews, Opportunities and Challenges10 Apr 2023
50 newest of 56 All 56 (JSON)
- 2023Interpretable Online Log Analysis Using Large Language Models with Prompt Strategiescited by 34
- 2023LogGPT: Exploring ChatGPT for Log-Based Anomaly Detectioncited by 33
- 2022Deep Learning for Anomaly Detection in Log Data: A Surveycited by 27
- 2023LogGPT: Log Anomaly Detection via GPTcited by 26
- 2024LogLLM: Log-based Anomaly Detection Using Large Language Modelscited by 21
- 2022Tele-Knowledge Pre-training for Fault Analysiscited by 18
- 2023Log Parsing: How Far Can ChatGPT Go?cited by 16
- 2023AI for IT Operations (AIOps) on Cloud Platforms: Reviews, Opportunities and Challengescited by 13
- 2024LogLM: From Task-based to Instruction-based Automated Log Analysiscited by 13
- 2022LogGD:Detecting Anomalies from System Logs by Graph Neural Networkscited by 8
- 2023Graph Neural Networks based Log Anomaly Detection and Explanationcited by 8
- 2023A Critical Review of Common Log Data Sets Used for Evaluation of Sequence-based Anomaly Detection Techniquescited by 7
12 most cited of 53 All 53 (JSON)
- 2026Resilient Concurrent Causal Discovery for Topological Event Sequences22 Aug 2026
- 2026Too Sure to Be Safe: Model Calibration for Reliable Log Anomaly Detection18 Aug 2026
- 2026Sample-Efficient LLM-Based Detection of Malicious Web Server Logs with Forensically Explainable Reasoning7 Jun 2026
- 2026NLLog: Lightweight, Explainable SOC Anomaly Detection via Log-to-Language Rewriting3 Jun 2026
- 2026LLM-Enhanced Log Anomaly Detection: A Comprehensive Benchmark of Large Language Models for Automated System Diagnostics14 Apr 2026
- 2026SCOPE: Tree-based Self-Correcting Online Log Parsing via Syntactic-Semantic Collaboration28 Mar 2026
- 2026KRONE: Scalable LLM-Augmented Log Anomaly Detection via Hierarchical Abstraction7 Feb 2026
- 2026ContraLog: Log File Anomaly Detection with Contrastive Learning and Masked Language Modeling3 Feb 2026
- 2026Log anomaly detection via Meta Learning and Prototypical Networks for Cross domain generalization20 Jan 2026
- 2025A unified framework for detecting point and collective anomalies in operating system logs via collaborative transformers29 Dec 2025
- 2025FedLAD: A Modular and Adaptive Testbed for Federated Log Anomaly Detection9 Dec 2025
- 2025LogPurge: Log Data Purification for Anomaly Detection via Rule-Enhanced Filtering18 Nov 2025
12 newest of 53 All 53 (JSON)