# MoniLog: An Automated Log-Based Anomaly Detection System for Cloud Computing Infrastructures

arXiv: https://arxiv.org/abs/2304.11940 · HTML: https://mlsanity.com/paper/2304.11940/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 38 references that are in the map.
- First posted on arXiv 24 Apr 2023.

## Builds on (most cited first, 5 of 5)

- [Bidirectional LSTM-CRF Models for Sequence Tagging](https://mlsanity.com/paper/1508.01991/) (2015)
- [Tools and Benchmarks for Automated Log Parsing](https://mlsanity.com/paper/1811.03509/) (2018)
- [Evaluation Metrics for Unsupervised Learning Algorithms](https://mlsanity.com/paper/1905.05667/) (2019)
- [Logram: Efficient Log Parsing Using n-Gram Dictionaries](https://mlsanity.com/paper/2001.03038/) (2020)
- [Learning Latent Events from Network Message Logs](https://mlsanity.com/paper/1804.03346/) (2018)

## Built on by (most cited first, 2 of 2)

- [Research on Cloud Platform Network Traffic Monitoring and Anomaly Detection System based on Large Language Models](https://mlsanity.com/paper/2504.17807/) (2025)
- [Log anomaly detection via Meta Learning and Prototypical Networks for Cross domain generalization](https://mlsanity.com/paper/2601.14336/) (2026)

## Abstract (arXiv)

Within today's large-scale systems, one anomaly can impact millions of users. Detecting such events in real-time is essential to maintain the quality of services. It allows the monitoring team to prevent or diminish the impact of a failure. Logs are a core part of software development and maintenance, by recording detailed information at runtime. Such log data are universally available in nearly all computer systems. They enable developers as well as system maintainers to monitor and dissect anomalous events. For Cloud computing companies and large online platforms in general, growth is linked to the scaling potential. Automatizing the anomaly detection process is a promising way to ensure the scalability of monitoring capacities regarding the increasing volume of logs generated by modern systems. In this paper, we will introduce MoniLog, a distributed approach to detect real-time anomalies within large-scale environments. It aims to detect sequential and quantitative anomalies within a multi-source log stream. MoniLog is designed to structure a log stream and perform the monitoring of anomalous sequences. Its output classifier learns from the administrator's actions to label and evaluate the criticality level of anomalies.