# Deep Learning for Anomaly Detection in Log Data: A Survey

arXiv: https://arxiv.org/abs/2207.03820 · HTML: https://mlsanity.com/paper/2207.03820/

## Key facts

- Cited by 28 papers in the map (data through 14 Oct 2026).
- Builds on 21 of its 121 references that are in the map.
- First posted on arXiv 8 Jul 2022.

## Builds on (most cited first, 21 of 21)

- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [Efficient Estimation of Word Representations in Vector Space](https://mlsanity.com/paper/1301.3781/) (2013)
- [Explainable Artificial Intelligence (XAI): Concepts, Taxonomies, Opportunities and Challenges toward Responsible AI](https://mlsanity.com/paper/1910.10045/) (2019)
- [Generalized Cross Entropy Loss for Training Deep Neural Networks with Noisy Labels](https://mlsanity.com/paper/1805.07836/) (2018)
- [Deep Learning for Anomaly Detection: A Survey](https://mlsanity.com/paper/1901.03407/) (2019)
- [LogBERT: Log Anomaly Detection via BERT](https://mlsanity.com/paper/2103.04475/) (2021)
- [Log-based Anomaly Detection Without Log Parsing](https://mlsanity.com/paper/2108.01955/) (2021)
- [Log-based Anomaly Detection with Deep Learning: How Far Are We?](https://mlsanity.com/paper/2202.04301/) (2022)
- [Tools and Benchmarks for Automated Log Parsing](https://mlsanity.com/paper/1811.03509/) (2018)
- [Experience Report: Deep Learning-based System Log Analysis for Anomaly Detection](https://mlsanity.com/paper/2107.05908/) (2021)
- [Self-Attentive Classification-Based Anomaly Detection in Unstructured Logs](https://mlsanity.com/paper/2008.09340/) (2020)
- [Multi-Scale One-Class Recurrent Neural Networks for Discrete Event Sequence Anomaly Detection](https://mlsanity.com/paper/2008.13361/) (2020)
- [Continuous online sequence learning with an unsupervised neural network model](https://mlsanity.com/paper/1512.05463/) (2015)
- [Robust and Transferable Anomaly Detection in Log Data using Pre-Trained Language Models](https://mlsanity.com/paper/2102.11570/) (2021)
- [A2Log: Attentive Augmented Log Anomaly Detection](https://mlsanity.com/paper/2109.09537/) (2021)
- [Maintainable Log Datasets for Evaluation of Intrusion Detection Systems](https://mlsanity.com/paper/2203.08580/) (2022)
- [OneLog: Towards End-to-End Training in Software Log Anomaly Detection](https://mlsanity.com/paper/2104.07324/) (2021)
- [TransLog: A Unified Transformer-based Framework for Log Anomaly Detection](https://mlsanity.com/paper/2201.00016/) (2021)
- [Log Message Anomaly Detection and Classification Using Auto-B/LSTM and Auto-GRU](https://mlsanity.com/paper/1911.08744/) (2019)
- [Comparison of Evolving Granular Classifiers applied to Anomaly Detection for Predictive Maintenance in Computing Centers](https://mlsanity.com/paper/2005.04156/) (2020)
- [Pinpointing Anomaly Events in Logs from Stability Testing -- N-Grams vs. Deep-Learning](https://mlsanity.com/paper/2202.09214/) (2022)

## Built on by (most cited first, 28 of 28)

- [Unifying the Perspectives of NLP and Software Engineering: A Survey on Language Models for Code](https://mlsanity.com/paper/2311.07989/) (2023)
- [LogGPT: Log Anomaly Detection via GPT](https://mlsanity.com/paper/2309.14482/) (2023)
- [Tele-Knowledge Pre-training for Fault Analysis](https://mlsanity.com/paper/2210.11298/) (2022)
- [TrajAudit: Automated Failure Diagnosis for Agentic Coding Systems](https://mlsanity.com/paper/2605.26563/) (2026)
- [LogGD:Detecting Anomalies from System Logs by Graph Neural Networks](https://mlsanity.com/paper/2209.07869/) (2022)
- [A Critical Review of Common Log Data Sets Used for Evaluation of Sequence-based Anomaly Detection Techniques](https://mlsanity.com/paper/2309.02854/) (2023)
- [Reducing Events to Augment Log-based Anomaly Detection Models: An Empirical Study](https://mlsanity.com/paper/2409.04834/) (2024)
- [TransNAS-TSAD: Harnessing Transformers for Multi-Objective Neural Architecture Search in Time Series Anomaly Detection](https://mlsanity.com/paper/2311.18061/) (2023)
- [AD-NEV: A Scalable Multi-level Neuroevolution Framework for Multivariate Anomaly Detection](https://mlsanity.com/paper/2305.16497/) (2023)
- [System Log Parsing with Large Language Models: A Review](https://mlsanity.com/paper/2504.04877/) (2025)
- [Hypergraph-Guided Regex Filter Synthesis for Event-Based Anomaly Detection](https://mlsanity.com/paper/2509.06911/) (2025)
- [ReTabAD: A Benchmark for Restoring Semantic Context in Tabular Anomaly Detection](https://mlsanity.com/paper/2510.02060/) (2025)
- [ADALog: Adaptive Unsupervised Anomaly detection in Logs with Self-attention Masked Language Model](https://mlsanity.com/paper/2505.13496/) (2025)
- [LogLead -- Fast and Integrated Log Loader, Enhancer, and Anomaly Detector](https://mlsanity.com/paper/2311.11809/) (2023)
- [ALPHA: LLM-Enabled Active Learning for Human-Free Network Anomaly Detection](https://mlsanity.com/paper/2509.05936/) (2025)
- [Contextual Learning for Anomaly Detection in Tabular Data](https://mlsanity.com/paper/2509.09030/) (2025)
- [FedLAD: A Modular and Adaptive Testbed for Federated Log Anomaly Detection](https://mlsanity.com/paper/2512.08277/) (2025)
- [AIOps-Driven Enhancement of Log Anomaly Detection in Unsupervised Scenarios](https://mlsanity.com/paper/2311.02621/) (2023)
- [RAPID: Training-free Retrieval-based Log Anomaly Detection with PLM considering Token-level information](https://mlsanity.com/paper/2311.05160/) (2023)
- [Classification of Home Network Problems with Transformers](https://mlsanity.com/paper/2312.01445/) (2023)
- [AD-NEv++ : The multi-architecture neuroevolution-based multivariate anomaly detection framework](https://mlsanity.com/paper/2404.07968/) (2024)
- [TPLogAD: Unsupervised Log Anomaly Detection Based on Event Templates and Key Parameters](https://mlsanity.com/paper/2411.15250/) (2024)
- [A unified framework for detecting point and collective anomalies in operating system logs via collaborative transformers](https://mlsanity.com/paper/2512.23380/) (2025)
- [ContraLog: Log File Anomaly Detection with Contrastive Learning and Masked Language Modeling](https://mlsanity.com/paper/2602.03678/) (2026)
- [KRONE: Scalable LLM-Augmented Log Anomaly Detection via Hierarchical Abstraction](https://mlsanity.com/paper/2602.07303/) (2026)
- [Sample-Efficient LLM-Based Detection of Malicious Web Server Logs with Forensically Explainable Reasoning](https://mlsanity.com/paper/2606.08649/) (2026)
- [Beyond Heavy Log Curation: Perplexity-Based APT Detection via Unsupervised, Context-Augmented Language Models](https://mlsanity.com/paper/2607.20832/) (2026)
- [Protocol-Sensitive Evaluation of Log Anomaly Detection: Component Costs and Target-Access Sensitivity on HDFS and BGL](https://mlsanity.com/paper/2610.05807/) (2026)

## Abstract (arXiv)

Automatic log file analysis enables early detection of relevant incidents such as system failures. In particular, self-learning anomaly detection techniques capture patterns in log data and subsequently report unexpected log event occurrences to system operators without the need to provide or manually model anomalous scenarios in advance. Recently, an increasing number of approaches leveraging deep learning neural networks for this purpose have been presented. These approaches have demonstrated superior detection performance in comparison to conventional machine learning techniques and simultaneously resolve issues with unstable data formats. However, there exist many different architectures for deep learning and it is non-trivial to encode raw and unstructured log data to be analyzed by neural networks. We therefore carry out a systematic literature review that provides an overview of deployed models, data pre-processing mechanisms, anomaly detection techniques, and evaluations. The survey does not quantitatively compare existing approaches but instead aims to help readers understand relevant aspects of different model architectures and emphasizes open issues for future work.