{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,22]],"date-time":"2026-05-22T12:10:47Z","timestamp":1779451847870,"version":"3.53.1"},"reference-count":45,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62372106"],"award-info":[{"award-number":["62372106"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2020YFB1805204"],"award-info":[{"award-number":["2020YFB1805204"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100008081","name":"Southeast University","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100008081","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Knowledge-Based Systems"],"published-print":{"date-parts":[[2026,5]]},"DOI":"10.1016\/j.knosys.2026.115844","type":"journal-article","created":{"date-parts":[[2026,3,24]],"date-time":"2026-03-24T23:49:50Z","timestamp":1774396190000},"page":"115844","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["LogSnippet: Online frequent snippet mining and multi-event tokenization for compact log representation and anomaly detection"],"prefix":"10.1016","volume":"341","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-8695-3763","authenticated-orcid":false,"given":"Jun","family":"Ma","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8348-6277","authenticated-orcid":false,"given":"Qingjun","family":"Xiao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0437-7898","authenticated-orcid":false,"given":"Bingjin","family":"Wu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3725-5755","authenticated-orcid":false,"given":"Hang","family":"Chen","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6804-1990","authenticated-orcid":false,"given":"Yongchao","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7504-8688","authenticated-orcid":false,"given":"Guang","family":"Cheng","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.knosys.2026.115844_bib0001","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2019.105054","article-title":"Discovering process models for the analysis of application failures under uncertainty of event logs","volume":"189","author":"Pecchia","year":"2020","journal-title":"Knowl. Based Syst."},{"key":"10.1016\/j.knosys.2026.115844_bib0002","article-title":"Timed pattern-based analysis of collaboration failures in system-of-systems","volume":"198","author":"Hyun","year":"2023","journal-title":"JSS"},{"key":"10.1016\/j.knosys.2026.115844_bib0003","series-title":"Proc. of ACM FSE","article-title":"An empirical study of log analysis at microsoft","author":"He","year":"2022"},{"key":"10.1016\/j.knosys.2026.115844_bib0004","series-title":"Proc. of IEEE ICDM","first-page":"583","article-title":"Failure prediction in ibm bluegene\/l event logs","author":"Liang","year":"2007"},{"key":"10.1016\/j.knosys.2026.115844_bib0005","series-title":"Proc. of ACM SIGOPS","article-title":"Detecting large-scale system problems by mining console logs","author":"Xu","year":"2009"},{"key":"10.1016\/j.knosys.2026.115844_bib0006","series-title":"Proc. of IEEE ICSE","article-title":"Log clustering based problem identification for online service systems","author":"Lin","year":"2016"},{"key":"10.1016\/j.knosys.2026.115844_bib0007","series-title":"Proc. of ACM CCS","article-title":"Deeplog: anomaly detection and diagnosis from system logs through deep learning","author":"Du","year":"2017"},{"key":"10.1016\/j.knosys.2026.115844_bib0008","series-title":"IEEE ICMLA","article-title":"Causalconvlstm: semi-supervised log anomaly detection through sequence modeling","author":"Yen","year":"2019"},{"key":"10.1016\/j.knosys.2026.115844_bib0009","series-title":"IJCAI","article-title":"Loganomaly: unsupervised detection of sequential and quantitative anomalies in unstructured logs","author":"Meng","year":"2019"},{"key":"10.1016\/j.knosys.2026.115844_bib0010","series-title":"Proc. of ACM ESEC\/FSE","first-page":"807","article-title":"Robust log-based anomaly detection on unstable log data","author":"Zhang","year":"2019"},{"key":"10.1016\/j.knosys.2026.115844_bib0011","series-title":"Proc. of IEEE BigData","first-page":"1117","article-title":"Loggpt: log anomaly detection via gpt","author":"Han","year":"2023"},{"key":"10.1016\/j.knosys.2026.115844_bib0012","series-title":"AAAI","article-title":"Seq2Pat: sequence-to-pattern generation for constraint-based sequential pattern mining","author":"Wang","year":"2022"},{"key":"10.1016\/j.knosys.2026.115844_bib0013","doi-asserted-by":"crossref","DOI":"10.1109\/TNET.2023.3268980","article-title":"Accurate and o (1)-time query of per-flow cardinality in high-speed networks","author":"Xiao","year":"2023","journal-title":"IEEE\/ACM TON"},{"issue":"6","key":"10.1016\/j.knosys.2026.115844_bib0014","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3460345","article-title":"A survey on automated log analysis for reliability engineering","volume":"54","author":"He","year":"2021","journal-title":"ACM Comput. Surv. (CSUR)"},{"key":"10.1016\/j.knosys.2026.115844_bib0015","series-title":"Proc. of IEEE INFOCOM","article-title":"Rule-based anomaly detection on IP flows","author":"Duffield","year":"2009"},{"key":"10.1016\/j.knosys.2026.115844_bib0016","series-title":"Proc. of ACM FSE","first-page":"1404","article-title":"An empirical investigation of practical log anomaly detection for online service systems","author":"Zhao","year":"2021"},{"key":"10.1016\/j.knosys.2026.115844_bib0017","series-title":"Proc. of IEEE ACSOS","article-title":"Failure diagnosis using decision trees","author":"Chen","year":"2004"},{"key":"10.1016\/j.knosys.2026.115844_bib0018","series-title":"Proc. of IEEE ISSRE","article-title":"Experience report: system log analysis for anomaly detection","author":"He","year":"2016"},{"key":"10.1016\/j.knosys.2026.115844_bib0019","series-title":"Proc. of IEEE\/ACM ASE","first-page":"492","article-title":"Log-based anomaly detection without log parsing","author":"Le","year":"2021"},{"issue":"3","key":"10.1016\/j.knosys.2026.115844_bib0020","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3654966","article-title":"Prelog: a pre-trained model for log analytics","volume":"2","author":"Le","year":"2024","journal-title":"Proc. ACM Manage. Data"},{"key":"10.1016\/j.knosys.2026.115844_bib0021","series-title":"Proc. of AAAI","article-title":"Logformer: a pre-train and tuning pipeline for log anomaly detection","author":"Guo","year":"2024"},{"key":"10.1016\/j.knosys.2026.115844_bib0022","series-title":"Proc. of the Association for Computational Linguistics: Human Language Technologies","first-page":"258","article-title":"Faster and smaller n-gram language models","author":"Pauls","year":"2011"},{"key":"10.1016\/j.knosys.2026.115844_bib0023","series-title":"Findings of the Association for Computational Linguistics: EMNLP 2022","first-page":"1523","article-title":"Residual learning of neural text generation with n-gram language model","author":"Li","year":"2022"},{"key":"10.1016\/j.knosys.2026.115844_bib0024","series-title":"Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)","first-page":"1715","article-title":"Neural machine translation of rare words with subword units","author":"Sennrich","year":"2016"},{"key":"10.1016\/j.knosys.2026.115844_bib0025","series-title":"Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing: System Demonstrations","article-title":"SentencePiece: a simple and language independent subword tokenizer and detokenizer for neural text processing","author":"Kudo","year":"2018"},{"issue":"12","key":"10.1016\/j.knosys.2026.115844_bib0026","doi-asserted-by":"crossref","first-page":"8981","DOI":"10.1109\/TKDE.2024.3438274","article-title":"Opf-miner: order-preserving pattern mining with forgetting mechanism for time series","volume":"36","author":"Li","year":"2024","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"10.1016\/j.knosys.2026.115844_bib0027","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2025.114434","article-title":"Development of an enhanced heart attack diagnosis model using knowledge distillation and frequent sequence pattern mining","volume":"330","author":"Bhawnani","year":"2025","journal-title":"Knowl. Based Syst."},{"key":"10.1016\/j.knosys.2026.115844_bib0028","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2024.111449","article-title":"SN-RNSP: Mining self-adaptive nonoverlapping repetitive negative sequential patterns in transaction sequences","volume":"287","author":"Sun","year":"2024","journal-title":"Knowl. Based Syst."},{"key":"10.1016\/j.knosys.2026.115844_bib0029","doi-asserted-by":"crossref","first-page":"186","DOI":"10.1016\/j.infsof.2017.07.009","article-title":"An anomaly detection system based on variable N-gram features and one-class SVM","volume":"91","author":"Khreich","year":"2017","journal-title":"Inf. Softw. Technol."},{"issue":"1","key":"10.1016\/j.knosys.2026.115844_bib0030","first-page":"54","article-title":"A survey of sequential pattern mining","volume":"1","author":"Fournier-Viger","year":"2017","journal-title":"DSPR"},{"key":"10.1016\/j.knosys.2026.115844_bib0031","series-title":"Proc. of IEEE ICDE","article-title":"Prefixspan: mining sequential patterns efficiently by prefix-projected pattern growth","author":"Han","year":"2001"},{"issue":"1","key":"10.1016\/j.knosys.2026.115844_bib0032","doi-asserted-by":"crossref","first-page":"58","DOI":"10.1016\/j.jalgor.2003.12.001","article-title":"An improved data stream summary: the count-min sketch and its applications","volume":"55","author":"Cormode","year":"2005","journal-title":"J. Algor."},{"key":"10.1016\/j.knosys.2026.115844_bib0033","series-title":"Proc.of PMLR","article-title":"Mission: ultra large-scale feature selection using count-sketches","author":"Aghazadeh","year":"2018"},{"key":"10.1016\/j.knosys.2026.115844_bib0034","series-title":"Proc. of IEEE ISSRE","article-title":"Loghub: a large collection of system log datasets for ai-driven log analytics","author":"Zhu","year":"2023"},{"key":"10.1016\/j.knosys.2026.115844_bib0035","series-title":"Proc. of ACL","article-title":"BART: denoising sequence-to-sequence pre-training for natural language generation, translation, and comprehension","author":"Lewis","year":"2020"},{"key":"10.1016\/j.knosys.2026.115844_bib0036","series-title":"Proc. of IEEE ICWS","article-title":"Drain: an online log parsing approach with fixed depth tree","author":"He","year":"2017"},{"key":"10.1016\/j.knosys.2026.115844_bib0037","article-title":"AML: an accuracy metric model for effective evaluation of log parsing techniques","volume":"216","author":"Sedki","year":"2024","journal-title":"JSS"},{"key":"10.1016\/j.knosys.2026.115844_bib0038","doi-asserted-by":"crossref","DOI":"10.1016\/j.jss.2025.112349","article-title":"LogGzip: towards log parsing with lossless compression","author":"Gao","year":"2025","journal-title":"J. Syst. Softw."},{"issue":"1","key":"10.1016\/j.knosys.2026.115844_bib0039","first-page":"58","article-title":"Analysis of statistical properties of variables in log data for advanced anomaly detection in cyber security","volume":"55","author":"Wurzenberger","year":"2024","journal-title":"Comput. Secur."},{"key":"10.1016\/j.knosys.2026.115844_bib0040","first-page":"127","article-title":"Hyperloglog: the analysis of a near-optimal cardinality estimation algorithm","volume":"127","author":"Flajolet","year":"2007","journal-title":"DMTCS"},{"issue":"6","key":"10.1016\/j.knosys.2026.115844_bib0041","doi-asserted-by":"crossref","first-page":"3738","DOI":"10.1109\/TNET.2017.2753842","article-title":"Cardinality estimation for elephant flows: a compact solution based on virtual register sharing","volume":"25","author":"Xiao","year":"2017","journal-title":"IEEE\/ACM TON"},{"key":"10.1016\/j.knosys.2026.115844_bib0042","unstructured":"X. Rong, word2vec parameter learning explained, arXiv (2014)."},{"key":"10.1016\/j.knosys.2026.115844_bib0043","series-title":"Proc. of IEEE\/IFIP DSN","first-page":"575","article-title":"What supercomputers say: a study of five system logs","author":"Oliner","year":"2007"},{"key":"10.1016\/j.knosys.2026.115844_bib0044","series-title":"Proc. of IEEE\/ACM ICSE","article-title":"Log-based anomaly detection with deep learning: how far are we?","author":"Le","year":"2022"},{"key":"10.1016\/j.knosys.2026.115844_bib0045","series-title":"Proc. of ACL","first-page":"1702","article-title":"Text categorization as a graph classification problem","author":"Rousseau","year":"2015"}],"container-title":["Knowledge-Based Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0950705126005708?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0950705126005708?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,5,22]],"date-time":"2026-05-22T11:44:32Z","timestamp":1779450272000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0950705126005708"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5]]},"references-count":45,"alternative-id":["S0950705126005708"],"URL":"https:\/\/doi.org\/10.1016\/j.knosys.2026.115844","relation":{},"ISSN":["0950-7051"],"issn-type":[{"value":"0950-7051","type":"print"}],"subject":[],"published":{"date-parts":[[2026,5]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"LogSnippet: Online frequent snippet mining and multi-event tokenization for compact log representation and anomaly detection","name":"articletitle","label":"Article Title"},{"value":"Knowledge-Based Systems","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.knosys.2026.115844","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier B.V. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"115844"}}