{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,30]],"date-time":"2026-09-30T21:02:30Z","timestamp":1790802150525,"version":"4.1.0"},"reference-count":42,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2022,12,3]],"date-time":"2022-12-03T00:00:00Z","timestamp":1670025600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2022,12,3]],"date-time":"2022-12-03T00:00:00Z","timestamp":1670025600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Autom Softw Eng"],"published-print":{"date-parts":[[2023,5]]},"DOI":"10.1007\/s10515-022-00370-w","type":"journal-article","created":{"date-parts":[[2022,12,3]],"date-time":"2022-12-03T17:03:04Z","timestamp":1670086984000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":21,"title":["Semi-supervised and unsupervised anomaly detection by mining numerical workflow relations from system logs"],"prefix":"10.1007","volume":"30","author":[{"given":"Bo","family":"Zhang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hongyu","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Van-Hoang","family":"Le","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Pablo","family":"Moscato","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Aozhong","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2022,12,3]]},"reference":[{"key":"370_CR1","doi-asserted-by":"crossref","unstructured":"Astekin, M., Zengin, H., S\u00f6zer, H.: Evaluation of distributed machine learning algorithms for anomaly detection from large-scale system logs: a case study. In: 2018 IEEE International Conference on Big Data (Big Data), pp. 2071\u20132077 (2018)","DOI":"10.1109\/BigData.2018.8621967"},{"key":"370_CR2","doi-asserted-by":"crossref","unstructured":"Bertero, C., Roy, M., Sauvanaud, C., et\u00a0al.: Experience report: log mining using natural language processing and application to anomaly detection. In: 2017 IEEE 28th International Symposium on Software Reliability Engineering (ISSRE), pp. 351\u2013360 (2017)","DOI":"10.1109\/ISSRE.2017.43"},{"key":"370_CR3","doi-asserted-by":"crossref","unstructured":"Bodik, P., Goldszmidt, M., Fox, A., et\u00a0al.: Fingerprinting the datacenter: automated classification of performance crises. In: Proceedings of the 5th European Conference on Computer Systems. ACM, Paris, France, EuroSys \u201910, pp. 111\u2013124 (2010)","DOI":"10.1145\/1755913.1755926"},{"issue":"3","key":"370_CR4","doi-asserted-by":"publisher","first-page":"497","DOI":"10.1007\/s11277-015-3128-1","volume":"94","author":"J Breier","year":"2017","unstructured":"Breier, J., Brani\u0161ov\u00e1, J.: A dynamic rule creation based anomaly detection method for identifying security breaches in log records. Wirel. Pers. Commun. 94(3), 497\u2013511 (2017)","journal-title":"Wirel. Pers. Commun."},{"key":"370_CR5","unstructured":"Chen, M., Zheng, A.X., Lloyd, J., et\u00a0al.: Failure diagnosis using decision trees. In: International Conference on Autonomic Computing, 2004. Proceedings., pp. 36\u201343 (2004)"},{"key":"370_CR6","doi-asserted-by":"crossref","unstructured":"Du, M., Li, F.: Spell: streaming parsing of system event logs. In: 2016 IEEE 16th International Conference on Data Mining (ICDM), pp. 859\u2013864 (2016)","DOI":"10.1109\/ICDM.2016.0103"},{"key":"370_CR7","doi-asserted-by":"crossref","unstructured":"Du, M., Li, F., Zheng, G., et\u00a0al.: DeepLog: anomaly detection and diagnosis from system logs through deep learning. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. ACM, Dallas, Texas, USA, CCS \u201917, pp. 1285\u20131298 (2017)","DOI":"10.1145\/3133956.3134015"},{"key":"370_CR8","doi-asserted-by":"crossref","unstructured":"Farshchi, M., Schneider, J., Weber, I., et\u00a0al.: Experience report: anomaly detection of cloud application operations using log and cloud metric correlation analysis. In: 2015 IEEE 26th International Symposium on Software Reliability Engineering (ISSRE), pp. 24\u201334 (2015)","DOI":"10.1109\/ISSRE.2015.7381796"},{"key":"370_CR9","doi-asserted-by":"crossref","unstructured":"Fu, Q., Lou, J.G., Wang, Y., et\u00a0al.: Execution anomaly detection in distributed systems through unstructured log analysis. In: International Conference on Data Mining (Full Paper). IEEE, pp. 149\u2013158 (2009)","DOI":"10.1109\/ICDM.2009.60"},{"key":"370_CR10","doi-asserted-by":"crossref","unstructured":"Hamooni, H., Debnath, B., Xu, J., et\u00a0al.: LogMine: fast pattern recognition for log analytics. In: Proceedings of the 25th ACM International on Conference on Information and Knowledge Management. ACM, Indianapolis, Indiana, USA, CIKM \u201916, pp. 1573\u20131582 (2016)","DOI":"10.1145\/2983323.2983358"},{"key":"370_CR11","doi-asserted-by":"crossref","unstructured":"He, P., Zhu, J., Zheng, Z., et\u00a0al.: Drain: an online log parsing approach with fixed depth tree. In: 2017 IEEE International Conference on Web Services (ICWS), pp. 33\u201340 (2017)","DOI":"10.1109\/ICWS.2017.13"},{"key":"370_CR12","doi-asserted-by":"crossref","unstructured":"He, S., Zhu, J., He, P., et\u00a0al.: Experience report: system log analysis for anomaly detection. In: 2016 IEEE 27th International Symposium on Software Reliability Engineering (ISSRE), pp. 207\u2013218 (2016)","DOI":"10.1109\/ISSRE.2016.21"},{"key":"370_CR13","doi-asserted-by":"crossref","unstructured":"He, S., Lin, Q., Lou, J.G., et\u00a0al.: Identifying impactful service system problems via log analysis. In: Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. ACM, Lake Buena Vista, FL, USA, ESEC\/FSE 2018, pp. 60\u201370 (2018)","DOI":"10.1145\/3236024.3236083"},{"key":"370_CR14","unstructured":"He, S., Zhu, J., He, P., et\u00a0al.: Loghub: a large collection of system log datasets towards automated log analytics. arXiv:2008.06448 [cs] (2020)"},{"issue":"4","key":"370_CR15","doi-asserted-by":"publisher","first-page":"249","DOI":"10.1002\/smr.374","volume":"20","author":"ZM Jiang","year":"2008","unstructured":"Jiang, Z.M., Hassan, A.E., Hamann, G., et al.: An automated approach for abstracting execution logs to execution events. J. Softw. Maint. Evol. Res. Pract. 20(4), 249\u2013267 (2008)","journal-title":"J. Softw. Maint. Evol. Res. Pract."},{"key":"370_CR16","doi-asserted-by":"crossref","unstructured":"Kruegel, C., Vigna, G.: Anomaly detection of web-based attacks. In: Proceedings of the 10th ACM Conference on Computer and Communications Security. ACM, Washington D.C., USA, CCS \u201903, pp. 251\u2013261 (2003)","DOI":"10.1145\/948109.948144"},{"key":"370_CR17","doi-asserted-by":"crossref","unstructured":"Le, V.H., Zhang, H.: Log-based anomaly detection without log parsing. In: 2021 36th IEEE\/ACM International Conference on Automated Software Engineering (ASE), IEEE, pp. 492\u2013504 (2021)","DOI":"10.1109\/ASE51524.2021.9678773"},{"key":"370_CR18","doi-asserted-by":"crossref","unstructured":"Le, V.H., Zhang, H.: Log-based anomaly detection with deep learning: How far are we? In: 2022 IEEE\/ACM 44th International Conference on Software Engineering (ICSE), IEEE, pp. 1356\u20131367 (2022)","DOI":"10.1145\/3510003.3510155"},{"key":"370_CR19","doi-asserted-by":"crossref","unstructured":"Li, T., Jiang, Y., Zeng, C., et\u00a0al.: FLAP: An end-to-end event log analysis platform for system management. In: Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. ACM, Halifax, NS, Canada, KDD \u201917, pp. 1547\u20131556 (2017)","DOI":"10.1145\/3097983.3098022"},{"key":"370_CR20","doi-asserted-by":"crossref","unstructured":"Liang, Y., Zhang, Y., Xiong, H., et\u00a0al.: Failure prediction in IBM BlueGene\/L event logs. In: Seventh IEEE International Conference on Data Mining (ICDM 2007), pp. 583\u2013588 (2007)","DOI":"10.1109\/ICDM.2007.46"},{"key":"370_CR21","doi-asserted-by":"crossref","unstructured":"Lin, Q., Zhang, H., Lou, J., et\u00a0al.: Log clustering based problem identification for online service systems. In: 2016 IEEE\/ACM 38th International Conference on Software Engineering (ICSE), pp. 102\u2013111 (2016)","DOI":"10.1145\/2889160.2889232"},{"key":"370_CR22","doi-asserted-by":"crossref","unstructured":"Liu, F.T., Ting, K.M., Zhou, Z.: Isolation forest. In: 2008 Eighth IEEE International Conference on Data Mining, pp. 413\u2013422 (2008)","DOI":"10.1109\/ICDM.2008.17"},{"key":"370_CR23","doi-asserted-by":"crossref","unstructured":"Lou, J.G., Fu, Q., Yang, S., et\u00a0al.: Mining program workflow from interleaved traces. In: Proceedings of the 16th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. ACM, Washington, DC, USA, KDD \u201910, pp. 613\u2013622 (2010)","DOI":"10.1145\/1835804.1835883"},{"issue":"11","key":"370_CR24","doi-asserted-by":"publisher","first-page":"1921","DOI":"10.1109\/TKDE.2011.138","volume":"24","author":"A Makanju","year":"2012","unstructured":"Makanju, A., Zincir-Heywood, A.N., Milios, E.E.: A lightweight algorithm for message type extraction in system application logs. IEEE Trans. Knowl. Data Eng. 24(11), 1921\u20131936 (2012)","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"370_CR25","doi-asserted-by":"crossref","unstructured":"Makanju, A.A., Zincir-Heywood, A.N., Milios, E.E.: Clustering event logs using iterative partitioning. In: Proceedings of the 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, KDD \u201909, pp. 1255\u20131264 (2009)","DOI":"10.1145\/1557019.1557154"},{"key":"370_CR26","doi-asserted-by":"crossref","unstructured":"Mariani, L., Pastore, F.: Automated identification of failure causes in system logs. In: 2008 19th International Symposium on Software Reliability Engineering (ISSRE), pp. 117\u2013126 (2008)","DOI":"10.1109\/ISSRE.2008.48"},{"key":"370_CR27","doi-asserted-by":"crossref","unstructured":"Meng, W., Liu, Y., Zhu, Y., et\u00a0al.: LogAnomaly: unsupervised detection of sequential and quantitative anomalies in unstructured logs. In: IJCAI, pp. 4739\u20134745 (2019)","DOI":"10.24963\/ijcai.2019\/658"},{"key":"370_CR28","doi-asserted-by":"crossref","unstructured":"Meng, W., Liu, Y., Zhang, S., et\u00a0al.: LogClass: anomalous log identification and classification with partial labels. IEEE Transactions on Network and Service Management p. 1 (2021)","DOI":"10.1109\/TNSM.2021.3055425"},{"key":"370_CR29","unstructured":"Mikolov, T., Sutskever, I., Chen, K., et\u00a0al.: Distributed representations of words and phrases and their compositionality. arXiv preprint arXiv:1310.4546 (2013)"},{"key":"370_CR30","doi-asserted-by":"crossref","unstructured":"Nedelkoski, S., Bogatinovski, J., Acker, A., et\u00a0al.: Self-attentive classification-based anomaly detection in unstructured logs. arXiv:2008.09340 [cs, stat] (2020)","DOI":"10.1109\/ICDM50108.2020.00148"},{"key":"370_CR31","doi-asserted-by":"crossref","unstructured":"Oliner, A., Stearley, J.: What supercomputers say: a study of five system logs. In: 37th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN\u201907), pp. 575\u2013584 (2007)","DOI":"10.1109\/DSN.2007.103"},{"key":"370_CR32","first-page":"2825","volume":"12","author":"F Pedregosa","year":"2011","unstructured":"Pedregosa, F., Varoquaux, G., Gramfort, A., et al.: Scikit-learn: machine learning in python. J. Mach. Learn. Res. 12, 2825\u20132830 (2011)","journal-title":"J. Mach. Learn. Res."},{"key":"370_CR33","volume-title":"Introduction to Probability and Statistics for Engineers and Scientists","author":"SM Ross","year":"2009","unstructured":"Ross, S.M.: Introduction to Probability and Statistics for Engineers and Scientists, 4th edn. Academic Press, Amsterdam, Boston (2009)","edition":"4"},{"key":"370_CR34","volume-title":"Linear Algebra and Its Applications","author":"G Strang","year":"2006","unstructured":"Strang, G.: Linear Algebra and Its Applications, 4th edn. Cengage Learning, Belmont, CA (2006)","edition":"4"},{"issue":"3","key":"370_CR35","doi-asserted-by":"publisher","first-page":"261","DOI":"10.1038\/s41592-019-0686-2","volume":"17","author":"P Virtanen","year":"2020","unstructured":"Virtanen, P., Gommers, R., Oliphant, T.E., et al.: SciPy 1.0: fundamental algorithms for scientific computing in Python. Nat. Methods 17(3), 261\u2013272 (2020)","journal-title":"Nat. Methods"},{"issue":"2","key":"370_CR36","doi-asserted-by":"publisher","first-page":"22","DOI":"10.1109\/MCSE.2011.37","volume":"13","author":"S van der Walt","year":"2011","unstructured":"van der Walt, S., Colbert, S.C., Varoquaux, G.: The NumPy array: a structure for efficient numerical computation. Comput. Sci. Eng. 13(2), 22\u201330 (2011)","journal-title":"Comput. Sci. Eng."},{"key":"370_CR37","doi-asserted-by":"crossref","unstructured":"Xu, W., Huang, L., Fox, A., et\u00a0al.: Detecting large-scale system problems by mining console logs. In: Proceedings of the ACM SIGOPS 22Nd Symposium on Operating Systems Principles. ACM, Big Sky, Montana, USA, SOSP \u201909, pp. 117\u2013132 (2009)","DOI":"10.1145\/1629575.1629587"},{"key":"370_CR38","doi-asserted-by":"crossref","unstructured":"Yin, K., Yan, M., Xu, L., et\u00a0al.: Improving log-based anomaly detection with component-aware analysis. In: 2020 IEEE International Conference on Software Maintenance and Evolution (ICSME), IEEE, pp. 667\u2013671 (2020)","DOI":"10.1109\/ICSME46990.2020.00069"},{"key":"370_CR39","doi-asserted-by":"crossref","unstructured":"Zhang, B., Zhang, H., Moscato, P., et\u00a0al.: Anomaly detection via mining numerical workflow relations from logs. In: Proceedings of the 39th International Symposium on Reliable Distributed Systems (SRDS 2020), Shanghai, China (2020)","DOI":"10.1109\/SRDS51746.2020.00027"},{"key":"370_CR40","doi-asserted-by":"crossref","unstructured":"Zhang, X., Xu, Y., Lin, Q., et\u00a0al.: Robust log-based anomaly detection on unstable log data. In: Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. ACM, Tallinn, Estonia, ESEC\/FSE 2019, pp. 807\u2013817 (2019)","DOI":"10.1145\/3338906.3338931"},{"key":"370_CR41","doi-asserted-by":"crossref","unstructured":"Zhu, J., He, P., Fu, Q., et\u00a0al.: Learning to log: helping developers make informed logging decisions. In: Proceedings of the 37th International Conference on Software Engineering, Vol. 1. IEEE Press, Florence, Italy, ICSE \u201915, pp. 415\u2013425 (2015)","DOI":"10.1109\/ICSE.2015.60"},{"key":"370_CR42","doi-asserted-by":"crossref","unstructured":"Zhu, J., He, S., Liu, J., et\u00a0al.: Tools and benchmarks for automated log parsing. In: Proceedings of the 41st International Conference on Software Engineering: Software Engineering in Practice. IEEE Press, Montreal, Quebec, Canada, ICSE-SEIP \u201910, pp. 121\u2013130 (2019)","DOI":"10.1109\/ICSE-SEIP.2019.00021"}],"container-title":["Automated Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10515-022-00370-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10515-022-00370-w\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10515-022-00370-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,5,4]],"date-time":"2023-05-04T13:10:29Z","timestamp":1683205829000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10515-022-00370-w"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,12,3]]},"references-count":42,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2023,5]]}},"alternative-id":["370"],"URL":"https:\/\/doi.org\/10.1007\/s10515-022-00370-w","relation":{},"ISSN":["0928-8910","1573-7535"],"issn-type":[{"value":"0928-8910","type":"print"},{"value":"1573-7535","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,12,3]]},"assertion":[{"value":"28 July 2021","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"1 November 2022","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"3 December 2022","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}],"article-number":"4"}}