# A Critical Review of Common Log Data Sets Used for Evaluation of Sequence-based Anomaly Detection Techniques

arXiv: https://arxiv.org/abs/2309.02854 · HTML: https://mlsanity.com/paper/2309.02854/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 42 references that are in the map.
- First posted on arXiv 6 Sep 2023.

## Builds on (most cited first, 5 of 5)

- [LogBERT: Log Anomaly Detection via BERT](https://mlsanity.com/paper/2103.04475/) (2021)
- [Log-based Anomaly Detection with Deep Learning: How Far Are We?](https://mlsanity.com/paper/2202.04301/) (2022)
- [Experience Report: Deep Learning-based System Log Analysis for Anomaly Detection](https://mlsanity.com/paper/2107.05908/) (2021)
- [Deep Learning for Anomaly Detection in Log Data: A Survey](https://mlsanity.com/paper/2207.03820/) (2022)
- [OneLog: Towards End-to-End Training in Software Log Anomaly Detection](https://mlsanity.com/paper/2104.07324/) (2021)

## Built on by (most cited first, 8 of 8)

- [A Survey of AIOps in the Era of Large Language Models](https://mlsanity.com/paper/2507.12472/) (2025)
- [Research on Dynamic Data Flow Anomaly Detection based on Machine Learning](https://mlsanity.com/paper/2409.14796/) (2024)
- [EventADL: Open-Box Anomaly Detection and Localization Framework for Events in Cloud-Based Service Systems](https://mlsanity.com/paper/2605.00936/) (2026)
- [What Information Contributes to Log-based Anomaly Detection? Insights from a Configurable Transformer-Based Approach](https://mlsanity.com/paper/2409.20503/) (2024)
- [Beyond Window-Based Detection: A Graph-Centric Framework for Discrete Log Anomaly Detection](https://mlsanity.com/paper/2501.12166/) (2025)
- [Resource-Aware Deployment Optimization for Collaborative Intrusion Detection in Layered Networks](https://mlsanity.com/paper/2602.11851/) (2026)
- [Too Sure to Be Safe: Model Calibration for Reliable Log Anomaly Detection](https://mlsanity.com/paper/2608.17965/) (2026)
- [Protocol-Sensitive Evaluation of Log Anomaly Detection: Component Costs and Target-Access Sensitivity on HDFS and BGL](https://mlsanity.com/paper/2610.05807/) (2026)

## Abstract (arXiv)

Log data store event execution patterns that correspond to underlying workflows of systems or applications. While most logs are informative, log data also include artifacts that indicate failures or incidents. Accordingly, log data are often used to evaluate anomaly detection techniques that aim to automatically disclose unexpected or otherwise relevant system behavior patterns. Recently, detection approaches leveraging deep learning have increasingly focused on anomalies that manifest as changes of sequential patterns within otherwise normal event traces. Several publicly available data sets, such as HDFS, BGL, Thunderbird, OpenStack, and Hadoop, have since become standards for evaluating these anomaly detection techniques, however, the appropriateness of these data sets has not been closely investigated in the past. In this paper we therefore analyze six publicly available log data sets with focus on the manifestations of anomalies and simple techniques for their detection. Our findings suggest that most anomalies are not directly related to sequential manifestations and that advanced detection techniques are not required to achieve high detection rates on these data sets.