{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T20:25:11Z","timestamp":1783023911164,"version":"3.54.6"},"reference-count":58,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100002865","name":"Chongqing Municipal Science and Technology Bureau","doi-asserted-by":"publisher","award":["CSTB2025TIAD-STX0035"],"award-info":[{"award-number":["CSTB2025TIAD-STX0035"]}],"id":[{"id":"10.13039\/501100002865","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Engineering Applications of Artificial Intelligence"],"published-print":{"date-parts":[[2026,10]]},"DOI":"10.1016\/j.engappai.2026.115345","type":"journal-article","created":{"date-parts":[[2026,6,14]],"date-time":"2026-06-14T16:37:17Z","timestamp":1781455037000},"page":"115345","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"P2","title":["A graph-based file-level anomaly detection framework for system logs"],"prefix":"10.1016","volume":"181","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-0163-554X","authenticated-orcid":false,"given":"Yanni","family":"Tang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wenjing","family":"Xiong","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6736-4501","authenticated-orcid":false,"given":"Zhuoxing","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0984-1629","authenticated-orcid":false,"given":"Kaiqi","family":"Zhao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0824-0899","authenticated-orcid":false,"given":"Jiamou","family":"Liu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kui","family":"Liu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wu","family":"Chen","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.engappai.2026.115345_b1","unstructured":"Apache , (2015).https:\/\/skywalking.apache.org\/."},{"key":"10.1016\/j.engappai.2026.115345_b2","unstructured":"AspectJ, (2001).https:\/\/eclipse.dev\/aspectj\/."},{"key":"10.1016\/j.engappai.2026.115345_b3","series-title":"Software Architecture in Practice","author":"Bass","year":"2003"},{"issue":"9","key":"10.1016\/j.engappai.2026.115345_b4","first-page":"1943","article-title":"Sequencer: Sequence-to-sequence learning for end-to-end program repair","volume":"47","author":"Chen","year":"2019","journal-title":"IEEE Trans. Softw. Eng."},{"key":"10.1016\/j.engappai.2026.115345_b5","series-title":"2020 IEEE 31st International Symposium on Software Reliability Engineering","first-page":"37","article-title":"Logtransfer: Cross-system log anomaly detection for software systems with transfer learning","author":"Chen","year":"2020"},{"key":"10.1016\/j.engappai.2026.115345_b6","doi-asserted-by":"crossref","DOI":"10.1109\/TKDE.2022.3200459","article-title":"Gccad: Graph contrastive learning for anomaly detection","author":"Chen","year":"2022","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"10.1016\/j.engappai.2026.115345_b7","series-title":"Deep Learning with Python","author":"Chollet","year":"2021"},{"issue":"1","key":"10.1016\/j.engappai.2026.115345_b8","first-page":"46","article-title":"Autonomic rejuvenation of cloud applications as a countermeasure to software anomalies","volume":"51","author":"Di Sanzo","year":"2021","journal-title":"Softw.: Pr. Exp."},{"key":"10.1016\/j.engappai.2026.115345_b9","doi-asserted-by":"crossref","unstructured":"Du, M., Li, F., Zheng, G., Srikumar, V., 2017. Deeplog: Anomaly detection and diagnosis from system logs through deep learning. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. pp. 1285\u20131298.","DOI":"10.1145\/3133956.3134015"},{"key":"10.1016\/j.engappai.2026.115345_b10","series-title":"Patterns of Enterprise Application Architecture: Pattern Enterpr Applica Arch","author":"Fowler","year":"2012"},{"key":"10.1016\/j.engappai.2026.115345_b11","article-title":"Inductive representation learning on large graphs","volume":"30","author":"Hamilton","year":"2017","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"10.1016\/j.engappai.2026.115345_b12","doi-asserted-by":"crossref","first-page":"2300","DOI":"10.1109\/TIFS.2021.3053371","article-title":"Log-based anomaly detection with robust feature extraction and online learning","volume":"16","author":"Han","year":"2021","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.engappai.2026.115345_b13","doi-asserted-by":"crossref","unstructured":"Han, X., Yuan, S., 2021. Unsupervised Cross-system Log Anomaly Detection via Domain Adaptation. In: Proceedings of the 30th ACM International Conference on Information & Knowledge Management. pp. 3068\u20133072.","DOI":"10.1145\/3459637.3482209"},{"key":"10.1016\/j.engappai.2026.115345_b14","series-title":"Proceedings of the 24th International Conference on Software Engineering. ICSE 2002","first-page":"291","article-title":"Tracking down software bugs using automatic anomaly detection","author":"Hangal","year":"2002"},{"issue":"6","key":"10.1016\/j.engappai.2026.115345_b15","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3460345","article-title":"A survey on automated log analysis for reliability engineering","volume":"54","author":"He","year":"2021","journal-title":"ACM Comput. Surv."},{"key":"10.1016\/j.engappai.2026.115345_b16","series-title":"2016 IEEE 27th International Symposium on Software Reliability Engineering","first-page":"207","article-title":"Experience report: System log analysis for anomaly detection","author":"He","year":"2016"},{"key":"10.1016\/j.engappai.2026.115345_b17","series-title":"Loghub: a large collection of system log datasets towards automated log analytics","author":"He","year":"2020"},{"issue":"1","key":"10.1016\/j.engappai.2026.115345_b18","doi-asserted-by":"crossref","first-page":"49","DOI":"10.1007\/s10270-006-0040-x","article-title":"Survey of reliability and availability prediction methods from the viewpoint of software architecture","volume":"7","author":"Immonen","year":"2008","journal-title":"Softw. Syst. Model."},{"key":"10.1016\/j.engappai.2026.115345_b19","series-title":"Detecting false alarms from automatic static analysis tools: How far are we?","author":"Kang","year":"2022"},{"issue":"4","key":"10.1016\/j.engappai.2026.115345_b20","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/2382577.2382579","article-title":"Leakage in data mining: Formulation, detection, and avoidance","volume":"6","author":"Kaufman","year":"2012","journal-title":"ACM Trans. Knowl. Discov. from Data (TKDD)"},{"key":"10.1016\/j.engappai.2026.115345_b21","series-title":"Semi-supervised classification with graph convolutional networks","author":"Kipf","year":"2016"},{"key":"10.1016\/j.engappai.2026.115345_b22","series-title":"Variational graph auto-encoders","author":"Kipf","year":"2016"},{"key":"10.1016\/j.engappai.2026.115345_b23","unstructured":"Kipf, T.N., Welling, M., 2017. Semi-supervised classification with graph convolutional networks. In: International Conference on Learning Representations (ICLR\u20192017)."},{"key":"10.1016\/j.engappai.2026.115345_b24","series-title":"2021 36th IEEE\/ACM International Conference on Automated Software Engineering","first-page":"492","article-title":"Log-based anomaly detection without log parsing","author":"Le","year":"2021"},{"key":"10.1016\/j.engappai.2026.115345_b25","doi-asserted-by":"crossref","unstructured":"Le, V.-H., Zhang, H., 2022. Log-based anomaly detection with deep learning: how far are we?. In: Proceedings of the 44th International Conference on Software Engineering. pp. 1356\u20131367.","DOI":"10.1145\/3510003.3510155"},{"key":"10.1016\/j.engappai.2026.115345_b26","series-title":"Expert C# Business Objects","author":"Lhotka","year":"2008"},{"key":"10.1016\/j.engappai.2026.115345_b27","series-title":"2020 IEEE 31st International Symposium on Software Reliability Engineering","first-page":"92","article-title":"Swisslog: Robust and unified deep learning based log anomaly detection for diverse faults","author":"Li","year":"2020"},{"issue":"4","key":"10.1016\/j.engappai.2026.115345_b28","doi-asserted-by":"crossref","first-page":"1876","DOI":"10.1109\/TDSC.2023.3293111","article-title":"LogGraph: Log event graph learning aided robust fine-grained anomaly diagnosis","volume":"21","author":"Li","year":"2023","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"10.1016\/j.engappai.2026.115345_b29","series-title":"2016 IEEE\/ACM 38th International Conference on Software Engineering Companion (ICSE-C)","first-page":"102","article-title":"Log clustering based problem identification for online service systems","author":"Lin","year":"2016"},{"key":"10.1016\/j.engappai.2026.115345_b30","doi-asserted-by":"crossref","first-page":"390","DOI":"10.1016\/j.future.2021.05.024","article-title":"LogNADS: Network anomaly detection scheme based on log semantics representation","volume":"124","author":"Liu","year":"2021","journal-title":"Future Gener. Comput. Syst."},{"key":"10.1016\/j.engappai.2026.115345_b31","doi-asserted-by":"crossref","first-page":"30602","DOI":"10.1109\/ACCESS.2018.2843336","article-title":"An integrated method for anomaly detection from massive system logs","volume":"6","author":"Liu","year":"2018","journal-title":"IEEE Access"},{"issue":"9","key":"10.1016\/j.engappai.2026.115345_b32","first-page":"2012","article-title":"Which variables should i log?","volume":"47","author":"Liu","year":"2019","journal-title":"IEEE Trans. Softw. Eng."},{"key":"10.1016\/j.engappai.2026.115345_b33","unstructured":"Lou, J.-G., Fu, Q., Yang, S., Xu, Y., Li, J., 2010. Mining Invariants from Console Logs for System Problem Detection.. In: USENIX Annual Technical Conference. pp. 1\u201314."},{"key":"10.1016\/j.engappai.2026.115345_b34","series-title":"IJCAI","first-page":"4739","article-title":"LogAnomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs.","volume":"19","author":"Meng","year":"2019"},{"key":"10.1016\/j.engappai.2026.115345_b35","series-title":"2020 IEEE International Conference on Data Mining","first-page":"1196","article-title":"Self-attentive classification-based anomaly detection in unstructured logs","author":"Nedelkoski","year":"2020"},{"key":"10.1016\/j.engappai.2026.115345_b36","series-title":"37th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks","first-page":"575","article-title":"What supercomputers say: A study of five system logs","author":"Oliner","year":"2007"},{"key":"10.1016\/j.engappai.2026.115345_b37","unstructured":"OpenTracing, (2016).https:\/\/opentracing.io\/."},{"key":"10.1016\/j.engappai.2026.115345_b38","doi-asserted-by":"crossref","first-page":"49","DOI":"10.1023\/A:1022308532661","article-title":"Web services and business transactions","volume":"6","author":"Papazoglou","year":"2003","journal-title":"World Wide Web"},{"key":"10.1016\/j.engappai.2026.115345_b39","unstructured":"SLF 4J, (2004).https:\/\/www.slf4j.org\/."},{"key":"10.1016\/j.engappai.2026.115345_b40","article-title":"Gadbench: Revisiting and benchmarking supervised graph anomaly detection","volume":"36","author":"Tang","year":"2024","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"10.1016\/j.engappai.2026.115345_b41","first-page":"1","article-title":"Unseen anomaly detection from system logs","volume":"4","author":"Tang","year":"2026","journal-title":"Proceedings of the ACM on Management of Data"},{"issue":"2","key":"10.1016\/j.engappai.2026.115345_b42","doi-asserted-by":"crossref","first-page":"213","DOI":"10.14778\/3705829.3705840","article-title":"Substructure-aware log anomaly detection","volume":"18","author":"Tang","year":"2024","journal-title":"Proceedings of the VLDB Endowment"},{"key":"10.1016\/j.engappai.2026.115345_b43","doi-asserted-by":"crossref","unstructured":"Tu, F., Zhu, J., Zheng, Q., Zhou, M., 2018. Be careful of when: an empirical study on time-related misuse of issue tracking data. In: Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. pp. 307\u2013318.","DOI":"10.1145\/3236024.3236054"},{"key":"10.1016\/j.engappai.2026.115345_b44","series-title":"Pacific-Asia Conference on Knowledge Discovery and Data Mining","first-page":"66","article-title":"Glad-paw: Graph-based log anomaly detection by position aware weighted graph attention network","author":"Wan","year":"2021"},{"key":"10.1016\/j.engappai.2026.115345_b45","doi-asserted-by":"crossref","DOI":"10.1016\/j.eswa.2024.124082","article-title":"Loggt: cross-system log anomaly detection via heterogeneous graph feature and transfer learning","volume":"251","author":"Wang","year":"2024","journal-title":"Expert Syst. Appl."},{"issue":"5","key":"10.1016\/j.engappai.2026.115345_b46","doi-asserted-by":"crossref","first-page":"230","DOI":"10.1145\/502059.502057","article-title":"SEDA: An architecture for well-conditioned, scalable internet services","volume":"35","author":"Welsh","year":"2001","journal-title":"ACM SIGOPS Oper. Syst. Rev."},{"key":"10.1016\/j.engappai.2026.115345_b47","doi-asserted-by":"crossref","unstructured":"Wu, M., Pan, S., Zhou, C., Chang, X., Zhu, X., 2020. Unsupervised domain adaptive graph convolutional networks. In: Proceedings of the Web Conference 2020. pp. 1457\u20131467.","DOI":"10.1145\/3366423.3380219"},{"key":"10.1016\/j.engappai.2026.115345_b48","series-title":"LogGD: Detecting anomalies from system logs by graph neural networks","author":"Xie","year":"2022"},{"key":"10.1016\/j.engappai.2026.115345_b49","doi-asserted-by":"crossref","unstructured":"Xu, W., Huang, L., Fox, A., Patterson, D., Jordan, M.I., 2009a. Detecting large-scale system problems by mining console logs. In: Proceedings of the ACM SIGOPS 22nd Symposium on Operating Systems Principles. pp. 117\u2013132.","DOI":"10.1145\/1629575.1629587"},{"key":"10.1016\/j.engappai.2026.115345_b50","article-title":"Largescale system problem detection by mining console logs","author":"Xu","year":"2009","journal-title":"Proc. SOSP\u201909"},{"key":"10.1016\/j.engappai.2026.115345_b51","doi-asserted-by":"crossref","DOI":"10.1016\/j.ins.2023.119576","article-title":"Discrete log anomaly detection: A novel time-aware graph-based link prediction approach","volume":"647","author":"Yan","year":"2023","journal-title":"Inform. Sci."},{"key":"10.1016\/j.engappai.2026.115345_b52","series-title":"2021 IEEE\/ACM 43rd International Conference on Software Engineering","first-page":"1448","article-title":"Semi-supervised log-based anomaly detection via probabilistic label estimation","author":"Yang","year":"2021"},{"key":"10.1016\/j.engappai.2026.115345_b53","series-title":"DeepTraLog: Trace-log combined microservice anomaly detection through graph-based deep learning","author":"Zhang","year":"2022"},{"key":"10.1016\/j.engappai.2026.115345_b54","series-title":"Dane: Domain adaptive network embedding","author":"Zhang","year":"2019"},{"key":"10.1016\/j.engappai.2026.115345_b55","doi-asserted-by":"crossref","unstructured":"Zhang, X., Xu, Y., Lin, Q., Qiao, B., Zhang, H., Dang, Y., Xie, C., Yang, X., Cheng, Q., Li, Z., et al., 2019. Robust log-based anomaly detection on unstable log data. In: Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. pp. 807\u2013817.","DOI":"10.1145\/3338906.3338931"},{"issue":"2","key":"10.1016\/j.engappai.2026.115345_b56","doi-asserted-by":"crossref","first-page":"243","DOI":"10.1109\/TSE.2018.2887384","article-title":"Fault analysis and debugging of microservice systems: Industrial survey, benchmark system, and empirical study","volume":"47","author":"Zhou","year":"2018","journal-title":"IEEE Trans. Softw. Eng."},{"key":"10.1016\/j.engappai.2026.115345_b57","doi-asserted-by":"crossref","unstructured":"Zhou, X., Peng, X., Xie, T., Sun, J., Ji, C., Liu, D., Xiang, Q., He, C., 2019. Latent error prediction and fault localization for microservice applications by learning from system trace logs. In: Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. pp. 683\u2013694.","DOI":"10.1145\/3338906.3338961"},{"key":"10.1016\/j.engappai.2026.115345_b58","first-page":"1766","article-title":"Transfer learning of graph neural networks with ego-graph information maximization","volume":"34","author":"Zhu","year":"2021","journal-title":"Adv. Neural Inf. Process. Syst."}],"container-title":["Engineering Applications of Artificial Intelligence"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0952197626016295?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0952197626016295?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T19:59:39Z","timestamp":1783022379000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0952197626016295"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,10]]},"references-count":58,"alternative-id":["S0952197626016295"],"URL":"https:\/\/doi.org\/10.1016\/j.engappai.2026.115345","relation":{},"ISSN":["0952-1976"],"issn-type":[{"value":"0952-1976","type":"print"}],"subject":[],"published":{"date-parts":[[2026,10]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"A graph-based file-level anomaly detection framework for system logs","name":"articletitle","label":"Article Title"},{"value":"Engineering Applications of Artificial Intelligence","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.engappai.2026.115345","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier Ltd. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"115345"}}