mlsanityData to 7 Oct 2026

RAGLog: Log Anomaly Detection using Retrieval Augmented Generation

arXiv 2311.05261 ↗First posted 9 Nov 2023cs.CRcited by 19

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

The ability to detect log anomalies from system logs is a vital activity needed to ensure cyber resiliency of systems. It is applied for fault identification or facilitate cyber investigation and digital forensics. However, as logs belonging to different systems and components differ significantly, the challenge to perform such analysis is humanly challenging from the volume, variety and velocity of logs. This is further complicated by the lack or unavailability of anomalous log entries to develop trained machine learning or artificial intelligence models for such purposes. In this research work, we explore the use of a Retrieval Augmented Large Language Model that leverages a vector database to detect anomalies from logs. We used a Question and Answer configuration pipeline. To the best of our knowledge, our experiment which we called RAGLog is a novel one and the experimental results show much promise.

Key facts. Cited by 19 papers in the map (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 7 of its 20 references that are in the map. First posted on arXiv 9 Nov 2023.

Builds on

7 of 20 references.

References · 7

  1. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  2. 2017Prototypical Networks for Few-shot Learningcited by 3,001
  3. 2019Latent Retrieval for Weakly Supervised Open Domain Question Answeringcited by 691
  4. 2021Log-based Anomaly Detection Without Log Parsingcited by 59
  5. 2021Experience Report: Deep Learning-based System Log Analysis for Anomaly Detectioncited by 37
  6. 2023An Assessment of ChatGPT on Log Datacited by 11
  7. 2021OneLog: Towards End-to-End Training in Software Log Anomaly Detectioncited by 7

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 5; 2025: 10; 2026: 4.

19 papers.

Sort:

By area:

  1. 2024LogLLM: Log-based Anomaly Detection Using Large Language Modelscited by 21
  2. 2024LogLM: From Task-based to Instruction-based Automated Log Analysiscited by 13
  3. 2025Adaptive Root Cause Localization for Microservice Systems with Multi-Agent Recursion-of-Thoughtcited by 11
  4. 2025Large Language Models for Security Operations Centers: A Comprehensive Surveycited by 9
  5. 2024Adapting Large Language Models to Log Analysis with Interpretable Domain Knowledgecited by 6
  6. 2025Mapping the Landscape of Generative AI in Network Monitoring and Managementcited by 4
  7. 2024FastRAG: Retrieval Augmented Generation for Semi-structured Datacited by 3
  8. 2025LLMLogAnalyzer: A Clustering-Based Log Analysis Chatbot using Large Language Modelscited by 3
  9. 2026Bian Que: An Agentic Framework with Flexible Skill Arrangement for Online System Operationscited by 2
  10. 2024Enhancing Reasoning Capacity of SLM using Cognitive Enhancementcited by 1
  11. 2025Retrieval Augmented Anomaly Detection (RAAD): Nimble Model Adjustment Without Retrainingcited by 1
  12. 2025ADALog: Adaptive Unsupervised Anomaly detection in Logs with Self-attention Masked Language Modelcited by 1
7 more
  1. 2026CAM-LDS: Cyber Attack Manifestations for Automatic Interpretation of System Logs and Security Alertscited by 1
  2. 2025RationAnomaly: Log Anomaly Detection with Rationality via Chain-of-Thought and Reinforcement Learningcited by 0
  3. 2025FusionLog: Cross-System Log-based Anomaly Detection via Fusion of General and Proprietary Knowledgecited by 0
  4. 2025REFLEX: Reference-Free Evaluation of Log Summarization via Large Language Model Judgmentcited by 0
  5. 2025Debugging Tabular Log as Dynamic Graphscited by 0
  6. 2026KRONE: Scalable LLM-Augmented Log Anomaly Detection via Hierarchical Abstractioncited by 0
  7. 2026Sample-Efficient LLM-Based Detection of Malicious Web Server Logs with Forensically Explainable Reasoningcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Log Anomaly Detection with Large Language Models via Knowledge-Enriched Fusion
  2. 2024LLM meets ML: Data-efficient Anomaly Detection on Unstable Logs
  3. 2025Memory-Augmented Log Analysis with Phi-4-mini: Enhancing Threat Detection in Structured Security Logs ↗
  4. 2024MLAD: A Unified Model for Multi-system Log Anomaly Detection
  5. 2026Retrieval-Augmented LLMs for Security Incident Analysis
  6. 2025LLM-based event log analysis techniques: A survey
  7. 2025Adapting Large Language Models to Emerging Cybersecurity using Retrieval Augmented Generation
  8. 2025Logic-Driven Cybersecurity: A Novel Framework for System Log Anomaly Detection using Answer Set Programming ↗