# K4: Online Log Anomaly Detection Via Unsupervised Typicality Learning

arXiv: https://arxiv.org/abs/2507.20051 · HTML: https://mlsanity.com/paper/2507.20051/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 14 of its 35 references that are in the map.
- First posted on arXiv 26 Jul 2025.

## Builds on (most cited first, 14 of 14)

- [Sentence-BERT: Sentence Embeddings using Siamese BERT-Networks](https://mlsanity.com/paper/1908.10084/) (2019)
- [Efficient Estimation of Word Representations in Vector Space](https://mlsanity.com/paper/1301.3781/) (2013)
- [Qwen3 Embedding: Advancing Text Embedding and Reranking Through Foundation Models](https://mlsanity.com/paper/2506.05176/) (2025)
- [Improved Precision and Recall Metric for Assessing Generative Models](https://mlsanity.com/paper/1904.06991/) (2019)
- [Reliable Fidelity and Diversity Metrics for Generative Models](https://mlsanity.com/paper/2002.09797/) (2020)
- [FastText.zip: Compressing text classification models](https://mlsanity.com/paper/1612.03651/) (2016)
- [LogBERT: Log Anomaly Detection via BERT](https://mlsanity.com/paper/2103.04475/) (2021)
- [Density of States Estimation for Out-of-Distribution Detection](https://mlsanity.com/paper/2006.09273/) (2020)
- [Loghub: A Large Collection of System Log Datasets for AI-driven Log Analytics](https://mlsanity.com/paper/2008.06448/) (2020)
- [Log-based Anomaly Detection with Deep Learning: How Far Are We?](https://mlsanity.com/paper/2202.04301/) (2022)
- [LogLLM: Log-based Anomaly Detection Using Large Language Models](https://mlsanity.com/paper/2411.08561/) (2024)
- [Forte : Finding Outliers with Representation Typicality Estimation](https://mlsanity.com/paper/2410.01322/) (2024)
- [Large Language Models for Anomaly Detection in Computational Workflows: from Supervised Fine-Tuning to In-Context Learning](https://mlsanity.com/paper/2407.17545/) (2024)
- [FastLogAD: Log Anomaly Detection with Mask-Guided Pseudo Anomaly Generation and Discrimination](https://mlsanity.com/paper/2404.08750/) (2024)

## Built on by (most cited first, 6 of 6)

- [Trust The Typical](https://mlsanity.com/paper/2602.04581/) (2026)
- [Path-Lock Expert: Separating Reasoning Mode in Hybrid Thinking via Architecture-Level Separation](https://mlsanity.com/paper/2604.27201/) (2026)
- [Context Determines Optimal Architecture in Materials Segmentation](https://mlsanity.com/paper/2602.04154/) (2026)
- [Reliability-Gated Source Anchoring for Continual Test-Time Adaptation](https://mlsanity.com/paper/2605.14063/) (2026)
- [Privacy Policy Enforcement Guardrails for Data-Sensitive Retrieval-Augmented Generation](https://mlsanity.com/paper/2605.17034/) (2026)
- [CausalGuard: Conformal Inference under Graph Uncertainty](https://mlsanity.com/paper/2605.21928/) (2026)

## Abstract (arXiv)

Existing Log Anomaly Detection (LogAD) methods are often slow, dependent on error-prone parsing, and use unrealistic evaluation protocols. We introduce K4, an unsupervised and parser-independent framework for high-performance online detection. K4 transforms arbitrary log embeddings into compact four-dimensional descriptors (Precision, Recall, Density, Coverage) using efficient k-nearest neighbor (k-NN) statistics. These descriptors enable lightweight detectors to accurately score anomalies without retraining. Using a more realistic online evaluation protocol, K4 sets a new state-of-the-art (AUROC: 0.995-0.999), outperforming baselines by large margins while being orders of magnitude faster, with training under 4 seconds and inference as low as 4 μs.