{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,9]],"date-time":"2026-05-09T23:08:50Z","timestamp":1778368130120,"version":"3.51.4"},"publisher-location":"Cham","reference-count":22,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032190987","type":"print"},{"value":"9783032190994","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-3-032-19099-4_36","type":"book-chapter","created":{"date-parts":[[2026,5,9]],"date-time":"2026-05-09T22:14:35Z","timestamp":1778364875000},"page":"517-533","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["AnomalyExplainerBot: Explainable AI for\u00a0LLM-Based Anomaly Detection Using BERTViz and Captum"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-4098-0333","authenticated-orcid":false,"given":"Prasasthy","family":"Balasubramanian","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-1028-3907","authenticated-orcid":false,"given":"Dumindu","family":"Kankanamge","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9816-2240","authenticated-orcid":false,"given":"Ekaterina","family":"Gilman","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mourad","family":"Oussalah","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2026,4,1]]},"reference":[{"issue":"2","key":"36_CR1","doi-asserted-by":"publisher","first-page":"77","DOI":"10.21928\/uhdjst.v6n2y2022.pp77-84","volume":"6","author":"RR Abdalla","year":"2022","unstructured":"Abdalla, R.R., Jumaa, A.K.: Log file analysis based on machine learning: a survey: survey. UHD J. Sci. Technol. 6(2), 77\u201384 (2022)","journal-title":"UHD J. Sci. Technol."},{"key":"36_CR2","unstructured":"Achtibat, R., et al.: ATTNLRP: attention-aware layer-wise relevance propagation for transformers. arXiv preprint arXiv:2402.05602 (2024)"},{"key":"36_CR3","unstructured":"Ali, T., Kostakos, P.: HuntGPT: integrating machine learning-based anomaly detection and explainable ai with large language models (LLMs). arXiv preprint arXiv:2309.16021 (2023)"},{"key":"36_CR4","unstructured":"Almazrouei, E., et al.: The falcon series of open language models. arXiv preprint arXiv:2311.16867 (2023)"},{"key":"36_CR5","doi-asserted-by":"crossref","unstructured":"Balasubramanian, P., Seby, J., Kostakos, P.: Cygent: a cybersecurity conversational agent with log summarization powered by GPT-3. In: 2024 3rd International Conference on Artificial Intelligence For Internet of Things (AIIoT), pp. 1\u20136. IEEE (2024)","DOI":"10.1109\/AIIoT58432.2024.10574658"},{"key":"36_CR6","doi-asserted-by":"crossref","unstructured":"Balasubramanian, P., Seby, J., Kostakos, P.: Transformer-based LLMs in cybersecurity: an in-depth study on log anomaly detection and conversational defense mechanisms. In: 2023 IEEE International Conference on Big Data (BigData), pp. 3590\u20133599. IEEE. (2023)","DOI":"10.1109\/BigData59044.2023.10386976"},{"key":"36_CR7","doi-asserted-by":"crossref","unstructured":"Clark, K., et al.: What does Bert look at? an analysis of Bert\u2019s attention. arXiv preprint arXiv:1906.04341 (2019)","DOI":"10.18653\/v1\/W19-4828"},{"key":"36_CR8","unstructured":"Cybersecurity Ventures. 2023 Cybersecurity Almanac: 100 Facts, Figures, Predictions, and Statistics (2023). https:\/\/cybersecurityventures.com\/cybersecurity-almanac-2023\/. Accessed 14 Jun 2025"},{"key":"36_CR9","doi-asserted-by":"publisher","unstructured":"F\u00e4lt, M., Forsstr\u00f6m, S., Zhang, T.: Machine learning based anomaly detection of log files using ensemble learning and self-attention. In: 2021 5th International Conference on System Reliability and Safety (ICSRS) (2021). https:\/\/doi.org\/10.1109\/icsrs53853.2021.9660694","DOI":"10.1109\/icsrs53853.2021.9660694"},{"key":"36_CR10","doi-asserted-by":"crossref","unstructured":"He, M., et al.: LLMeLog: an approach for anomaly detection based on LLM-enriched log events. In: 2024 IEEE 35th International Symposium on Software Reliability Engineering (ISSRE). IEEE, pp.\u00a0132\u2013143. 2024","DOI":"10.1109\/ISSRE62328.2024.00023"},{"key":"36_CR11","unstructured":"He, P., et al.: Deberta: decoding-enhanced Bert with disentangled attention. arXiv preprint arXiv:2006.03654 (2020)"},{"key":"36_CR12","unstructured":"Kokhlikyan, N., et al.: Captum: a unified and generic model interpretability library for pytorch. In: arXiv preprint arXiv:2009.07896 (2020)"},{"key":"36_CR13","unstructured":"Liu, Y., et al.: Roberta: a robustly optimized Bert pretraining approach. arXiv preprint arXiv:1907.11692 (2019)"},{"key":"36_CR14","doi-asserted-by":"publisher","unstructured":"National Institute of Standards and Technology. Framework for Improving Critical Infrastructure Cybersecurity, Version1.1 (2018). https:\/\/nvlpubs.nist.gov\/nistpubs\/cswp\/nist.cswp.04162018.pdf. https:\/\/doi.org\/10.6028\/NIST.CSWP.04162018. Accessed 20 Jun 2025","DOI":"10.6028\/NIST.CSWP.04162018"},{"key":"36_CR15","unstructured":"Peng, B., et al.: Yarn: efficient context window extension of large language models. In: arXiv preprint arXiv:2309.00071 (2023)"},{"key":"36_CR16","doi-asserted-by":"crossref","unstructured":"Sarker, I.H., et al.: Explainable AI for cybersecurity automation, intelligence and trustworthiness in digital twin: methods, taxonomy, challenges and prospects. In: ICT Express (2024)","DOI":"10.1016\/j.icte.2024.05.007"},{"key":"36_CR17","first-page":"2582","volume":"3","author":"M Saxena","year":"2021","unstructured":"Saxena, M.: IoT dynamic log file analysis: security approach for anomaly detection in multi sensor environment. Int. Res. J. Modernization Eng. Technol. Sci. 3, 2582\u20135208 (2021)","journal-title":"Int. Res. J. Modernization Eng. Technol. Sci."},{"key":"36_CR18","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1016\/j.diin.2019.02.005","volume":"29","author":"H Studiawan","year":"2019","unstructured":"Studiawan, H., Sohel, F., Payne, C.: A survey on forensic investigation of operating system logs. Digit. Investig. 29, 1\u201320 (2019). https:\/\/doi.org\/10.1016\/j.diin.2019.02.005","journal-title":"Digit. Investig."},{"key":"36_CR19","unstructured":"Sundararajan, M., Taly, A., Yan, Q.: Axiomatic attribution for deep networks. In: International Conference on Machine Learning, pp. 3319\u20133328. PMLR (2017)"},{"key":"36_CR20","doi-asserted-by":"publisher","unstructured":"Tian, G., et al.: Cldtlog: system log anomaly detection method based on contrastive learning and dual objective tasks. Sensors 23, 5042 (2023). https:\/\/doi.org\/10.3390\/s23115042","DOI":"10.3390\/s23115042"},{"key":"36_CR21","unstructured":"Vig, J.: BertViz: a tool for visualizing multihead self-attention in the BERT model. In: ICLR Workshop: Debugging Machine Learning Models, vol. 3 (2019)"},{"key":"36_CR22","doi-asserted-by":"crossref","unstructured":"Zhu, J., et al.: Loghub: a large collection of system log datasets for AI-driven log analytics. In: 2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE), pp.\u00a0355\u2013366. IEEE (2023)","DOI":"10.1109\/ISSRE59848.2023.00071"}],"container-title":["Communications in Computer and Information Science","Machine Learning and Principles and Practice of Knowledge Discovery in Databases"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-19099-4_36","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,9]],"date-time":"2026-05-09T22:14:37Z","timestamp":1778364877000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-19099-4_36"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9783032190987","9783032190994"],"references-count":22,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-19099-4_36","relation":{},"ISSN":["1865-0929","1865-0937"],"issn-type":[{"value":"1865-0929","type":"print"},{"value":"1865-0937","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"1 April 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ECML PKDD","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Joint European Conference on Machine Learning and Knowledge Discovery in Databases","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Porto","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Portugal","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"15 September 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"19 September 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"ecml2025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/ecmlpkdd.org\/2025\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}