{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,22]],"date-time":"2026-05-22T22:04:57Z","timestamp":1779487497472,"version":"3.53.1"},"reference-count":36,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Neurocomputing"],"published-print":{"date-parts":[[2026,8]]},"DOI":"10.1016\/j.neucom.2026.133840","type":"journal-article","created":{"date-parts":[[2026,4,30]],"date-time":"2026-04-30T23:08:23Z","timestamp":1777590503000},"page":"133840","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["LogPhi: A multi-level anomaly detection method for heterogeneous logs using large language models and dynamic domain knowledge"],"prefix":"10.1016","volume":"690","author":[{"given":"Lei","family":"Wang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xinlong","family":"Zhou","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaoyong","family":"Zhao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yibao","family":"He","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.neucom.2026.133840_bib0005","doi-asserted-by":"crossref","first-page":"77","DOI":"10.21928\/uhdjst.v6n2y2022.pp77-84","article-title":"Log file analysis based on machine learning: a survey: survey","volume":"6","author":"Abdalla","year":"2022","journal-title":"UHD Journal of Science and Technology"},{"key":"10.1016\/j.neucom.2026.133840_bib0010","author":"Akhtar"},{"key":"10.1016\/j.neucom.2026.133840_bib0015","doi-asserted-by":"crossref","first-page":"1715","DOI":"10.1109\/TNSM.2024.3358730","article-title":"Logfit: log anomaly detection using fine-tuned language models","volume":"21","author":"Almodovar","year":"2024","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"10.1016\/j.neucom.2026.133840_bib0020","series-title":"2019 IEEE International Conference on Big Data (Big Data)","first-page":"2119","article-title":"Incremental analysis of large-scale system logs for anomaly detection","author":"Astekin","year":"2019"},{"key":"10.1016\/j.neucom.2026.133840_bib0025","series-title":"2017 IEEE 28th International Symposium on Software Reliability Engineering (ISSRE)","first-page":"351","article-title":"Experience report: log mining using natural language processing and application to anomaly detection","author":"Bertero","year":"2017"},{"key":"10.1016\/j.neucom.2026.133840_bib0030","author":"Cui"},{"key":"10.1016\/j.neucom.2026.133840_bib0035","series-title":"Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Long and Short Papers)","first-page":"4171","article-title":"BERT: pre-training of deep bidirectional transformers for language understanding","volume":"vol. 1","author":"Devlin","year":"2019"},{"key":"10.1016\/j.neucom.2026.133840_bib0040","series-title":"Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security","first-page":"1285","article-title":"Deeplog: anomaly detection and diagnosis from system logs through deep learning","author":"Du","year":"2017"},{"key":"10.1016\/j.neucom.2026.133840_bib0045","series-title":"2021 International Joint Conference on Neural Networks (IJCNN)","first-page":"1","article-title":"Logbert: log anomaly detection via BERT","author":"Guo","year":"2021"},{"key":"10.1016\/j.neucom.2026.133840_bib0050","doi-asserted-by":"crossref","first-page":"433","DOI":"10.1111\/coin.12573","article-title":"Distributed system anomaly detection using deep learning-based log analysis","volume":"39","author":"Han","year":"2023","journal-title":"Comput. Intell."},{"key":"10.1016\/j.neucom.2026.133840_bib0055","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3460345","article-title":"A survey on automated log analysis for reliability engineering","volume":"54","author":"He","year":"2021","journal-title":"ACM computing surveys (CSUR)"},{"key":"10.1016\/j.neucom.2026.133840_bib0060","doi-asserted-by":"crossref","first-page":"1735","DOI":"10.1162\/neco.1997.9.8.1735","article-title":"Long short-term memory","volume":"9","author":"Hochreiter","year":"1997","journal-title":"Neural Comput."},{"key":"10.1016\/j.neucom.2026.133840_bib0065","first-page":"3","article-title":"Lora: low-rank adaptation of large language models","volume":"1","author":"Hu","year":"2022","journal-title":"ICLR"},{"key":"10.1016\/j.neucom.2026.133840_bib0070","doi-asserted-by":"crossref","first-page":"44318","DOI":"10.1109\/JIOT.2025.3585884","article-title":"Deep learning advancements in anomaly detection: a comprehensive survey","volume":"12","author":"Huang","year":"2025","journal-title":"IEEE Internet Things J."},{"key":"10.1016\/j.neucom.2026.133840_bib0075","doi-asserted-by":"crossref","first-page":"59","DOI":"10.1007\/s10922-024-09831-x","article-title":"Benchmarking large language models for log analysis, security, and interpretation","volume":"32","author":"Karlsen","year":"2024","journal-title":"J. Netw. Syst. Manag."},{"key":"10.1016\/j.neucom.2026.133840_bib0080","article-title":"Deep learning for anomaly detection in log data: a survey","volume":"12","author":"Landauer","year":"2023","journal-title":"Mach. Learn. Appl."},{"key":"10.1016\/j.neucom.2026.133840_bib0085","series-title":"2021 36th IEEE\/ACM International Conference on Automated Software Engineering (ASE)","first-page":"492","article-title":"Log-based anomaly detection without log parsing","author":"Le","year":"2021"},{"key":"10.1016\/j.neucom.2026.133840_bib0090","series-title":"Proceedings of the 44th International Conference on Software Engineering","first-page":"1356","article-title":"Log-based anomaly detection with deep learning: how far are we?","author":"Le","year":"2022"},{"key":"10.1016\/j.neucom.2026.133840_bib0095","series-title":"Proceedings of the 38th International Conference on Software Engineering Companion","first-page":"102","article-title":"Log clustering based problem identification for online service systems","author":"Lin","year":"2016"},{"key":"10.1016\/j.neucom.2026.133840_bib0100","series-title":"2008 Eighth Ieee International Conference on Data Mining","first-page":"413","article-title":"Isolation forest","author":"Liu","year":"2008"},{"key":"10.1016\/j.neucom.2026.133840_bib0105","author":"Liu"},{"key":"10.1016\/j.neucom.2026.133840_bib0110","series-title":"2010 USENIX Annual Technical Conference (USENIX ATC 1)","article-title":"Mining invariants from console logs for system problem detection","author":"Lou","year":"2010"},{"key":"10.1016\/j.neucom.2026.133840_bib0115","doi-asserted-by":"crossref","first-page":"2455","DOI":"10.1109\/TSE.2025.3586700","article-title":"Practitioners\u2019 expectations on log anomaly detection","volume":"51","author":"Ma","year":"2025","journal-title":"IEEE Trans. Softw. Eng."},{"key":"10.1016\/j.neucom.2026.133840_bib0120","first-page":"4739","article-title":"Loganomaly: unsupervised detection of sequential and quantitative anomalies in unstructured logs","author":"Meng","year":"2019","journal-title":"IJCAI"},{"key":"10.1016\/j.neucom.2026.133840_bib0125","series-title":"37th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN\u201907)","first-page":"575","article-title":"What supercomputers say: a study of five system logs","author":"Oliner","year":"2007"},{"key":"10.1016\/j.neucom.2026.133840_bib0130","author":"OpenAI"},{"key":"10.1016\/j.neucom.2026.133840_bib0135","series-title":"2023 IEEE International Conference on High Performance Computing & Communications, Data Science & Systems, Smart City & Dependability in Sensor, Cloud & Big Data Systems & Application (HPCC\/DSS\/SmartCity\/DependSys)","first-page":"273","article-title":"Loggpt: exploring Chatgpt for log-based anomaly detection","author":"Qi","year":"2023"},{"key":"10.1016\/j.neucom.2026.133840_bib0140","series-title":"Proceedings of the 2024 IEEE\/ACM 46th International Conference on Software Engineering: Companion Proceedings","first-page":"392","article-title":"Decoding log parsing challenges: a comprehensive taxonomy for actionable solutions","author":"Sedki","year":"2024"},{"key":"10.1016\/j.neucom.2026.133840_bib0145","author":"Touvron"},{"key":"10.1016\/j.neucom.2026.133840_bib0150","series-title":"Proceedings from the Fifth Annual IEEE SMC Information Assurance Workshop, 2004, IEEE","first-page":"358","article-title":"Anomaly intrusion detection using one class SVM","author":"Wang","year":"2004"},{"key":"10.1016\/j.neucom.2026.133840_bib0155","series-title":"Proceedings of the ACM SIGOPS 22nd Symposium on Operating Systems Principles","first-page":"117","article-title":"Detecting large-scale system problems by mining console logs","author":"Xu","year":"2009"},{"key":"10.1016\/j.neucom.2026.133840_bib0160","doi-asserted-by":"crossref","first-page":"40","DOI":"10.21307\/ijanmc-2020-036","article-title":"Review of anomaly detection based on log analysis","volume":"5","author":"Xudong","year":"2020","journal-title":"International Journal of Advanced Network, Monitoring, and Controls"},{"key":"10.1016\/j.neucom.2026.133840_bib0165","doi-asserted-by":"crossref","first-page":"55","DOI":"10.1186\/s42400-025-00361-w","article-title":"When llms meet cybersecurity: a systematic literature review","volume":"8","author":"Zhang","year":"2025","journal-title":"Cybersecurity"},{"key":"10.1016\/j.neucom.2026.133840_bib0170","first-page":"8596","article-title":"System log parsing: a survey","volume":"35","author":"Zhang","year":"2023","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"10.1016\/j.neucom.2026.133840_bib0175","doi-asserted-by":"crossref","first-page":"2353","DOI":"10.1007\/s11036-021-01832-3","article-title":"A survey on log research of aiops: methods and trends","volume":"26","author":"Zhaoxue","year":"2021","journal-title":"Mob. Netw. Appl."},{"key":"10.1016\/j.neucom.2026.133840_bib0180","series-title":"2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE)","first-page":"355","article-title":"Loghub: a large collection of system log datasets for ai-driven log analytics","author":"Zhu","year":"2023"}],"container-title":["Neurocomputing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0925231226012373?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0925231226012373?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,5,22]],"date-time":"2026-05-22T21:24:29Z","timestamp":1779485069000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0925231226012373"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8]]},"references-count":36,"alternative-id":["S0925231226012373"],"URL":"https:\/\/doi.org\/10.1016\/j.neucom.2026.133840","relation":{},"ISSN":["0925-2312"],"issn-type":[{"value":"0925-2312","type":"print"}],"subject":[],"published":{"date-parts":[[2026,8]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"LogPhi: A multi-level anomaly detection method for heterogeneous logs using large language models and dynamic domain knowledge","name":"articletitle","label":"Article Title"},{"value":"Neurocomputing","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.neucom.2026.133840","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier B.V. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"133840"}}