# LogGPT: Log Anomaly Detection via GPT

arXiv: https://arxiv.org/abs/2309.14482 · HTML: https://mlsanity.com/paper/2309.14482/

## Key facts

- Cited by 26 papers in the map (data through 14 Oct 2026).
- Builds on 10 of its 26 references that are in the map.
- First posted on arXiv 25 Sep 2023.

## Builds on (most cited first, 10 of 10)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [Proximal Policy Optimization Algorithms](https://mlsanity.com/paper/1707.06347/) (2017)
- [Deep Learning for Anomaly Detection: A Survey](https://mlsanity.com/paper/1901.03407/) (2019)
- [Deep Learning for Anomaly Detection: A Review](https://mlsanity.com/paper/2007.02500/) (2020)
- [LogBERT: Log Anomaly Detection via BERT](https://mlsanity.com/paper/2103.04475/) (2021)
- [Log-based Anomaly Detection with Deep Learning: How Far Are We?](https://mlsanity.com/paper/2202.04301/) (2022)
- [Experience Report: Deep Learning-based System Log Analysis for Anomaly Detection](https://mlsanity.com/paper/2107.05908/) (2021)
- [Deep Learning for Anomaly Detection in Log Data: A Survey](https://mlsanity.com/paper/2207.03820/) (2022)
- [Multi-Scale One-Class Recurrent Neural Networks for Discrete Event Sequence Anomaly Detection](https://mlsanity.com/paper/2008.13361/) (2020)

## Built on by (most cited first, 26 of 26)

- [When LLMs Meet Cybersecurity: A Systematic Literature Review](https://mlsanity.com/paper/2405.03644/) (2024)
- [Large Language Models for Cyber Security: A Systematic Literature Review](https://mlsanity.com/paper/2405.04760/) (2024)
- [Time Series Language Model for Descriptive Caption Generation](https://mlsanity.com/paper/2501.01832/) (2025)
- [Large Language Models for Security Operations Centers: A Comprehensive Survey](https://mlsanity.com/paper/2509.10858/) (2025)
- [Beyond Detection: Leveraging Large Language Models for Cyber Attack Prediction in IoT Networks](https://mlsanity.com/paper/2408.14045/) (2024)
- [Mapping the Landscape of Generative AI in Network Monitoring and Management](https://mlsanity.com/paper/2502.08576/) (2025)
- [Evaluating Language Models For Threat Detection in IoT Security Logs](https://mlsanity.com/paper/2507.02390/) (2025)
- [LLMLogAnalyzer: A Clustering-Based Log Analysis Chatbot using Large Language Models](https://mlsanity.com/paper/2510.24031/) (2025)
- [Oddballness: universal anomaly detection with language models](https://mlsanity.com/paper/2409.03046/) (2024)
- [LogBabylon: A Unified Framework for Cross-Log File Integration and Analysis](https://mlsanity.com/paper/2412.12364/) (2024)
- [From Flows to Words: Can Zero-/Few-Shot LLMs Detect Network Intrusions? A Grammar-Constrained, Calibrated Evaluation on UNSW-NB15](https://mlsanity.com/paper/2510.17883/) (2025)
- [TeleDoCTR: Domain-Specific and Contextual Troubleshooting for Telecommunications](https://mlsanity.com/paper/2601.00691/) (2026)
- [Large Language Models in Cybersecurity: Applications, Vulnerabilities, and Defense Techniques](https://mlsanity.com/paper/2507.13629/) (2025)
- [RationAnomaly: Log Anomaly Detection with Rationality via Chain-of-Thought and Reinforcement Learning](https://mlsanity.com/paper/2509.14693/) (2025)
- [Architecting software monitors for control-flow anomaly detection through large language models and conformance checking](https://mlsanity.com/paper/2511.10876/) (2025)
- [JT-DA: Enhancing Data Analysis with Tool-Integrated Table Reasoning Large Language Models](https://mlsanity.com/paper/2512.06859/) (2025)
- [Automated Fault Detection in 5G Core Networks Using Large Language Models](https://mlsanity.com/paper/2512.19697/) (2025)
- [Next-generation cyberattack detection with large language models: anomaly analysis across heterogeneous logs](https://mlsanity.com/paper/2602.06777/) (2026)
- [KRONE: Scalable LLM-Augmented Log Anomaly Detection via Hierarchical Abstraction](https://mlsanity.com/paper/2602.07303/) (2026)
- [DP-FlogTinyLLM: Differentially private federated log anomaly detection using Tiny LLMs](https://mlsanity.com/paper/2604.19118/) (2026)
- [TraXion: Rethinking Pre-training Frameworks for Mobility and Beyond](https://mlsanity.com/paper/2605.06906/) (2026)
- [NLLog: Lightweight, Explainable SOC Anomaly Detection via Log-to-Language Rewriting](https://mlsanity.com/paper/2606.04957/) (2026)
- [LogNEO: A GPT-Neo Reinforcement Learning Framework for Accurate Real-Time Log Anomaly Detection](https://mlsanity.com/paper/2606.08153/) (2026)
- [Multi-Source Cybersecurity Logs: An ATT&CK-Labeled Dataset and SLM Evaluation](https://mlsanity.com/paper/2606.18190/) (2026)
- [Beyond Heavy Log Curation: Perplexity-Based APT Detection via Unsupervised, Context-Augmented Language Models](https://mlsanity.com/paper/2607.20832/) (2026)
- [ASTRA - Agentic System for Ticket Resolution and Analysis](https://mlsanity.com/paper/2608.28790/) (2026)

## Abstract (arXiv)

Detecting system anomalies based on log data is important for ensuring the security and reliability of computer systems. Recently, deep learning models have been widely used for log anomaly detection. The core idea is to model the log sequences as natural language and adopt deep sequential models, such as LSTM or Transformer, to encode the normal patterns in log sequences via language modeling. However, there is a gap between language modeling and anomaly detection as the objective of training a sequential model via a language modeling loss is not directly related to anomaly detection. To fill up the gap, we propose LogGPT, a novel framework that employs GPT for log anomaly detection. LogGPT is first trained to predict the next log entry based on the preceding sequence. To further enhance the performance of LogGPT, we propose a novel reinforcement learning strategy to finetune the model specifically for the log anomaly detection task. The experimental results on three datasets show that LogGPT significantly outperforms existing state-of-the-art approaches.