{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,3]],"date-time":"2026-07-03T17:05:00Z","timestamp":1783098300633,"version":"3.54.6"},"reference-count":56,"publisher":"Springer Science and Business Media LLC","issue":"6","license":[{"start":{"date-parts":[[2023,10,9]],"date-time":"2023-10-09T00:00:00Z","timestamp":1696809600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2023,10,9]],"date-time":"2023-10-09T00:00:00Z","timestamp":1696809600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Empir Software Eng"],"published-print":{"date-parts":[[2023,11]]},"DOI":"10.1007\/s10664-023-10364-1","type":"journal-article","created":{"date-parts":[[2023,10,9]],"date-time":"2023-10-09T09:38:17Z","timestamp":1696844297000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":36,"title":["On the effectiveness of log representation for log-based anomaly detection"],"prefix":"10.1007","volume":"28","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7040-3751","authenticated-orcid":false,"given":"Xingfang","family":"Wu","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5441-6763","authenticated-orcid":false,"given":"Heng","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5704-4173","authenticated-orcid":false,"given":"Foutse","family":"Khomh","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2023,10,9]]},"reference":[{"key":"10364_CR1","doi-asserted-by":"crossref","unstructured":"Chen M, Zheng AX, Lloyd J, Jordan MI, Brewer E (2004) Failure diagnosis using decision trees. In International Conference on Autonomic Computing, 2004. Proceedings., pages 36\u201343. IEEE","DOI":"10.1109\/ICAC.2004.1301345"},{"key":"10364_CR2","unstructured":"Chen Z, Liu J, Gu W, Su Y, Lyu MR (2021) Experience report: Deep learning-based system log analysis for anomaly detection. arXiv preprint arXiv:2107.05908"},{"key":"10364_CR3","unstructured":"Chow M, Meisner D, Flinn J, Peek D, Wenisch TF (2014) The mystery machine: End-to-end performance analysis of large-scale internet services. In 11th USENIX Symposium on Operating Systems Design and Implementation (OSDI 14), pages 217\u2013231"},{"key":"10364_CR4","doi-asserted-by":"publisher","unstructured":"Dai H, Li H, Chen CS, Shang W, Chen T-H (2020) Logram: Efficient log parsing using n-gram dictionaries. IEEE Transactions on Software Engineering 48(3):879\u2013892.\u00a0https:\/\/doi.org\/10.1109\/TSE.2020.3007554","DOI":"10.1109\/TSE.2020.3007554"},{"key":"10364_CR5","unstructured":"Devlin J, Chang M-W, Lee K, Toutanova K (2018) Bert:Pretraining of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805"},{"key":"10364_CR6","doi-asserted-by":"crossref","unstructured":"Du M, Li F, Zheng G, Srikumar V (2017) Deeplog: Anomaly detection and diagnosis from system logs through deep learning. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pages 1285\u20131298","DOI":"10.1145\/3133956.3134015"},{"key":"10364_CR7","doi-asserted-by":"crossref","unstructured":"El-Sayed N, Zhu H, Schroeder B (2017) Learning from failure across multiple clusters: A trace-driven approach to understanding, predicting, and mitigating job terminations. In 2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS), pages 1333\u20131344. IEEE","DOI":"10.1109\/ICDCS.2017.317"},{"key":"10364_CR8","doi-asserted-by":"crossref","unstructured":"Fu Q, Lou J-G, Wang Y, Li J (2009) Execution anomaly detection in distributed systems through unstructured log analysis. In 2009 ninth IEEE international conference on data mining, pages 149\u2013158. IEEE","DOI":"10.1109\/ICDM.2009.60"},{"key":"10364_CR9","doi-asserted-by":"crossref","unstructured":"Fu Q, Lou J-G, Lin Q, Ding R, Zhang D, Xie T (2013) Contextual analysis of program logs for understanding system behaviors. In 2013 10th Working Conference on Mining Software Repositories (MSR), pages 397\u2013 400. IEEE.","DOI":"10.1109\/MSR.2013.6624054"},{"key":"10364_CR10","unstructured":"Grave E, Bojanowski P, Gupta P, Joulin A, Mikolov T (2018) Learning word vectors for 157 languages. In Proceedings of the International Conference on Language Resources and Evaluation (LREC 2018)"},{"key":"10364_CR11","unstructured":"Hansen SE, Atkins ET (1993) Automated system monitoring and notification with swatch. In LISA, volume 93, pages 145\u2013152. Monterey, CA"},{"issue":"6","key":"10364_CR12","first-page":"1","volume":"54","author":"S He","year":"2021","unstructured":"He S, He P, Chen Z, Yang T, Su Y, Lyu MR (2021) A survey on automated log analysis for reliability engineering. ACM Comput Sur (CSUR) 54(6):1\u201337","journal-title":"ACM Comput Sur (CSUR)"},{"key":"10364_CR13","doi-asserted-by":"crossref","unstructured":"He P, Zhu J, He S, Li J, Lyu MR (2016a) An evaluation study on log parsing and its use in log mining. In 2016a 46th annual IEEE\/IFIP international conference on dependable systems and networks (DSN), pages 654\u2013661. IEEE","DOI":"10.1109\/DSN.2016.66"},{"key":"10364_CR14","doi-asserted-by":"crossref","unstructured":"He S, Zhu J, He P, Lyu MR (2016b) Experience report: System log analysis for anomaly detection. In 2016b IEEE 27th international symposium on software reliability engineering (ISSRE), pages 207\u2013218. IEEE","DOI":"10.1109\/ISSRE.2016.21"},{"key":"10364_CR15","doi-asserted-by":"crossref","unstructured":"He P, Zhu J, Zheng Z, Lyu MR (2017) Drain: An online log parsing approach with fixed depth tree. In 2017 IEEE international conference on web services (ICWS), pages 33\u201340. IEEE","DOI":"10.1109\/ICWS.2017.13"},{"key":"10364_CR16","unstructured":"He S, Zhu J, He P, Lyu MR (2020) Loghub: a large collection of system log datasets towards automated log analytics.arXiv preprint arXiv:2008.06448"},{"key":"10364_CR17","doi-asserted-by":"crossref","unstructured":"Jarry R, Kobayashi S, Fukuda K (2021) A quantitative causal analysis for network log data. In 2021 IEEE 45th Annual Computers, Software, and Applications Conference (COMPSAC), pages 1437\u20131442. IEEE","DOI":"10.1109\/COMPSAC51774.2021.00213"},{"key":"10364_CR18","unstructured":"Katkar DGS, Kasliwal AD (2014) Use of log data for predictive analytics through data mining. Current Trends in Technology and Science. Volume: 3, Issue: 3 (Apr-May 2014)"},{"key":"10364_CR19","doi-asserted-by":"crossref","unstructured":"Khan ZA, Shin D, Bianculli D, Briand L (2022) Guidelines for assessing the accuracy of log message template identification techniques. In Proceedings of the 44th International Conference on Software Engineering, pages 1095\u20131106","DOI":"10.1145\/3510003.3510101"},{"key":"10364_CR20","doi-asserted-by":"crossref","unstructured":"Le V-H, Zhang H (2021) Log-based anomaly detection without log parsing. In 2021 36th IEEE\/ACM International Conference on Automated Software Engineering (ASE), pages 492\u2013504. IEEE.","DOI":"10.1109\/ASE51524.2021.9678773"},{"key":"10364_CR21","doi-asserted-by":"crossref","unstructured":"Le V-H, Zhang H (2022) Log-based anomaly detection with deep learning: how far are we? In 2022 IEEE\/ACM 44th International Conference on Software Engineering (ICSE), pages 1356\u20131367. IEEE","DOI":"10.1145\/3510003.3510155"},{"key":"10364_CR22","doi-asserted-by":"crossref","unstructured":"Le V-H, Zhang H (2023) Log parsing with prompt-based few-shot learning. arXiv preprint arXiv:2302.07435.","DOI":"10.1109\/ICSE48619.2023.00204"},{"key":"10364_CR23","doi-asserted-by":"crossref","unstructured":"Li X, Chen P, Jing L, He Z, Yu G (2020) Swisslog: Robust and unified deep learning based log anomaly detection for diverse faults. In 2020 IEEE 31st International Symposium on Software Reliability Engineering (ISSRE), pages 92\u2013103. IEEE.","DOI":"10.1109\/ISSRE5003.2020.00018"},{"key":"10364_CR24","doi-asserted-by":"crossref","unstructured":"Liang Y, Zhang Y, Xiong H, Sahoo R (2007) Failure prediction in ibm bluegene\/l event logs. In Seventh IEEE International Conference on Data Mining (ICDM 2007), pages 583\u2013588. IEEE.","DOI":"10.1109\/ICDM.2007.46"},{"issue":"5","key":"10364_CR25","doi-asserted-by":"publisher","first-page":"4130","DOI":"10.1007\/s10664-020-09866-z","volume":"25","author":"L Liao","year":"2020","unstructured":"Liao L, Chen J, Li H, Zeng Y, Shang W, Guo J, Sporea C, Toma A, Sajedi S (2020) Using black-box performance models to detect performance regressions under varying workloads: an empirical study. Empir Softw Eng 25(5):4130\u20134160","journal-title":"Empir Softw Eng"},{"issue":"1","key":"10364_CR26","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/2133360.2133363","volume":"6","author":"FT Liu","year":"2012","unstructured":"Liu FT, Ting KM, Zhou Z-H (2012) Isolation-based anomaly detection. ACM Trans Knowl Discov Data (TKDD) 6(1):1\u201339","journal-title":"ACM Trans Knowl Discov Data (TKDD)"},{"key":"10364_CR27","first-page":"1893","volume":"2022","author":"Y Liu","year":"2022","unstructured":"Liu Y, Zhang X, He S, Zhang H, Li L, Kang Y, Xu Y, Ma M, Lin Q, Dang Y et al (2022) Uniparser: A unified log parser for heterogeneous log data. Proc ACM Web Conf 2022:1893\u20131901","journal-title":"Proc ACM Web Conf"},{"key":"10364_CR28","unstructured":"Lou J-G, Fu Q, Yang S, Xu Y, Li J (2010) Mining invariants from console logs for system problem detection. In 2010 USENIX Annual Technical Conference (USENIX ATC 10)"},{"key":"10364_CR29","doi-asserted-by":"crossref","unstructured":"Lu S, Wei X, Li Y, Wang L (2018) Detecting anomaly in big data system logs using convolutional neural network. In 2018 IEEE 16th Intl Conf on Dependable, Autonomic and Secure Computing, 16th Intl Conf on Pervasive Intelligence and Computing, 4th Intl Conf on Big Data Intelligence and Computing and Cyber Science and Technology Congress (DASC\/PiCom\/- DataCom\/CyberSciTech), pages 151\u2013158. IEEE","DOI":"10.1109\/DASC\/PiCom\/DataCom\/CyberSciTec.2018.00037"},{"issue":"4","key":"10364_CR30","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3447876","volume":"30","author":"Y Lyu","year":"2021","unstructured":"Lyu Y, Li H, Sayagh M, Jiang ZM, Hassan AE (2021) An empirical study of the impact of data splitting decisions on the performance of aiops solutions. ACM Trans Softw Eng Methodol (TOSEM) 30(4):1\u201338","journal-title":"ACM Trans Softw Eng Methodol (TOSEM)"},{"key":"10364_CR31","first-page":"4739","volume":"19","author":"W Meng","year":"2019","unstructured":"Meng W, Liu Y, Zhu Y, Zhang S, Pei D, Liu Y, Chen Y, Zhang R, Tao S, Sun P et al (2019) Loganomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs. In IJCAI 19:4739\u20134745","journal-title":"In IJCAI"},{"issue":"2","key":"10364_CR32","doi-asserted-by":"publisher","first-page":"1870","DOI":"10.1109\/TNSM.2021.3055425","volume":"18","author":"W Meng","year":"2021","unstructured":"Meng W, Liu Y, Zhang S, Zaiter F, Zhang Y, Huang Y, Yu Z, Zhang Y, Song L, Zhang M et al (2021) Logclass: Anomalous log identification and classification with partial labels. IEEE Trans Netw Serv Manage 18(2):1870\u20131884","journal-title":"IEEE Trans Netw Serv Manage"},{"key":"10364_CR33","unstructured":"Nagaraj K, Killian C, Neville J (2012) Structured comparative analysis of systems logs to diagnose performance problems. In 9th USENIX Symposium on Networked Systems Design and Implementation (NSDI 12), pages 353\u2013366"},{"key":"10364_CR34","doi-asserted-by":"crossref","unstructured":"Nedelkoski S, Bogatinovski J, Acker A, Cardoso J, Kao O (2020) Self-attentive classification-based anomaly detection in unstructured logs. In 2020 IEEE International Conference on Data Mining (ICDM), pages 1196\u20131201. IEEE","DOI":"10.1109\/ICDM50108.2020.00148"},{"key":"10364_CR35","doi-asserted-by":"crossref","unstructured":"Nguyen KA,Walde SSi, Vu NT (2016) Integrating distributional lexical contrast into word embeddings for antonym-synonym distinction. arXiv preprint arXiv:1605.07766.","DOI":"10.18653\/v1\/P16-2074"},{"issue":"2","key":"10364_CR36","doi-asserted-by":"publisher","first-page":"55","DOI":"10.1145\/2076450.2076466","volume":"55","author":"A Oliner","year":"2012","unstructured":"Oliner A, Ganapathi A, Xu W (2012) Advances and challenges in log analysis. Commun ACM 55(2):55\u201361","journal-title":"Commun ACM"},{"key":"10364_CR37","doi-asserted-by":"crossref","unstructured":"Oliner A, Stearley J (2007) What supercomputers say: A study of five system logs. In 37th annual IEEE\/IFIP international conference on dependable systems and networks (DSN\u201907), pages 575\u2013584. IEEE","DOI":"10.1109\/DSN.2007.103"},{"key":"10364_CR38","unstructured":"Prewett JE (2003) Analyzing cluster log files using logsurfer. In Proceedings of the 4th Annual Conference on Linux Clusters. Citeseer"},{"key":"10364_CR39","first-page":"133","volume":"4","author":"JP Rouillard","year":"2004","unstructured":"Rouillard JP (2004) Real-time log file analysis using the simple event correlator (sec). In LISA 4:133\u2013150","journal-title":"In LISA"},{"issue":"1","key":"10364_CR40","first-page":"11","volume":"19","author":"SA Rusticus","year":"2014","unstructured":"Rusticus SA, Lovato CY (2014) Impact of sample size and variability on the power and type i error rates of equivalence tests: A simulation study. Pract Assess Res Eval 19(1):11","journal-title":"Pract Assess Res Eval"},{"issue":"5","key":"10364_CR41","doi-asserted-by":"publisher","first-page":"513","DOI":"10.1016\/0306-4573(88)90021-0","volume":"24","author":"G Salton","year":"1988","unstructured":"Salton G, Buckley C (1988) Term-weighting approaches in automatic text retrieval. Inf Process Manage 24(5):513\u2013523","journal-title":"Inf Process Manage"},{"key":"10364_CR42","unstructured":"Schroeder B, Gibson GA (2007) Disk failures in the real world: What does an MTTF of 1,000,000 hours mean to you? In 5th USENIX Conference on File and Storage Technologies (FAST 07), San Jose, CA. USENIX Association"},{"issue":"1","key":"10364_CR43","first-page":"3","volume":"26","author":"W Shang","year":"2014","unstructured":"Shang W, Jiang ZM, Adams B, Hassan AE, Godfrey MW, Nasser M, Flora P (2014) An exploratory study of the evolution of communicated information about the execution of large software systems. J Softw: Evol Process 26(1):3\u201326","journal-title":"J Softw: Evol Process"},{"key":"10364_CR44","doi-asserted-by":"publisher","unstructured":"Tantithamthavorn C, McIntosh S, Hassan AE, Matsumoto K (2017) An empirical comparison of model validation techniques for defect prediction models. IEEE Transactions on Software Engineering 43(1):1\u201318.\u00a0\u00a0https:\/\/doi.org\/10.1109\/TSE.2016.2584050","DOI":"10.1109\/TSE.2016.2584050"},{"key":"10364_CR45","doi-asserted-by":"publisher","unstructured":"Tantithamthavorn C, McIntosh S, Hassan AE, Matsumoto K (2018) The Impact of Automated Parameter Optimization on Defect Prediction Models. IEEE Transactions on Software Engineering 45(7):683\u2013711. https:\/\/doi.org\/10.1109\/TSE.2018.2794977","DOI":"10.1109\/TSE.2018.2794977"},{"key":"10364_CR46","unstructured":"Turc I, Chang M-W, Lee K, Toutanova K (2019) Well-read students learn better: On the importance of pre-training compact models. arXiv preprint arXiv:1908.08962v2"},{"key":"10364_CR47","unstructured":"Van der Maaten L, Hinton G (2008) Visualizing data using t-SNE.\u00a0J Mach Learn Res\u00a09(11)"},{"key":"10364_CR48","unstructured":"Vaswani A, Shazeer N, Parmar N, Uszkoreit J, Jones L, Gomez AN, Kaiser L, Polosukhin I (2017) Attention is all you need. Advances in Neural Information Processing Systems, volume 30. Curran Associates, Inc."},{"key":"10364_CR49","doi-asserted-by":"crossref","unstructured":"Wan Y, Liu Y, Wang D, Wen Y (2021) Glad-paw: Graph-based log anomaly detection by position aware weighted graph attention network. In Advances in Knowledge Discovery and Data Mining: 25th Pacific-Asia Conference, PAKDD 2021, Virtual Event, May 11\u201314, 2021, Proceedings, Part I , pages 66\u201377. Springer","DOI":"10.1007\/978-3-030-75762-5_6"},{"key":"10364_CR50","doi-asserted-by":"crossref","unstructured":"Wang M, Xu L, Guo L (2018) Anomaly detection of system logs based on natural language processing and deep learning. In 2018 4th International Conference on Frontiers of Signal Processing (ICFSP), pages 140\u2013144. IEEE","DOI":"10.1109\/ICFSP.2018.8552075"},{"key":"10364_CR51","doi-asserted-by":"crossref","unstructured":"Xie Y, Zhang H, Babar MA (2022) Loggd: Detecting anomalies from system logs by graph neural networks. arXiv preprint arXiv:2209.07869","DOI":"10.1109\/QRS57517.2022.00039"},{"key":"10364_CR52","doi-asserted-by":"crossref","unstructured":"Xu W, Huang L, Fox A, Patterson D, Jordan MI (2009) Detecting large-scale system problems by mining console logs. In Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles, pages 117\u2013 132","DOI":"10.1145\/1629575.1629587"},{"key":"10364_CR53","doi-asserted-by":"crossref","unstructured":"Yuan D, Mai H, Xiong W, Tan L, Zhou Y, Pasupathy S (2010) Sherlog: error diagnosis by connecting clues from run-time logs. In Proceedings of the fifteenth International Conference on Architectural support for programming languages and operating systems, pages 143\u2013154","DOI":"10.1145\/1735971.1736038"},{"key":"10364_CR54","doi-asserted-by":"crossref","unstructured":"Yuan D, Park S, Zhou Y (2012) Characterizing logging practices in open-source software. In 2012 34th International Conference on Software Engineering (ICSE), pages 102\u2013112. IEEE","DOI":"10.1109\/ICSE.2012.6227202"},{"key":"10364_CR55","doi-asserted-by":"crossref","unstructured":"Zhang X, Xu Y, Lin Q, Qiao B, Zhang H, Dang Y, Xie C, Yang X, Cheng Q, Li Z, et al. (2019) Robust log-based anomaly detection on unstable log data. In Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pages 807\u2013817","DOI":"10.1145\/3338906.3338931"},{"key":"10364_CR56","doi-asserted-by":"crossref","unstructured":"Zhu J, He S, Liu J, He P, Xie Q, Zheng Z, Lyu MR (2019) Tools and benchmarks for automated log parsing. In 2019 IEEE\/ACM 41st International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP), pages 121\u2013130. IEEE","DOI":"10.1109\/ICSE-SEIP.2019.00021"}],"container-title":["Empirical Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10664-023-10364-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10664-023-10364-1\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10664-023-10364-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,10,30]],"date-time":"2024-10-30T10:54:17Z","timestamp":1730285657000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10664-023-10364-1"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,10,9]]},"references-count":56,"journal-issue":{"issue":"6","published-print":{"date-parts":[[2023,11]]}},"alternative-id":["10364"],"URL":"https:\/\/doi.org\/10.1007\/s10664-023-10364-1","relation":{},"ISSN":["1382-3256","1573-7616"],"issn-type":[{"value":"1382-3256","type":"print"},{"value":"1573-7616","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,10,9]]},"assertion":[{"value":"27 June 2023","order":1,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"9 October 2023","order":2,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors have no competing interests to declare that are relevant to the content of this article.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflicts of interests"}}],"article-number":"137"}}