{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,11]],"date-time":"2026-07-11T02:44:38Z","timestamp":1783737878108,"version":"3.55.0"},"reference-count":43,"publisher":"Association for Computing Machinery (ACM)","issue":"2","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Proc. VLDB Endow."],"published-print":{"date-parts":[[2024,10]]},"abstract":"<jats:p>System logs, recording critical information about system operations, serve as indispensable tools for system anomaly detection. Graph-based methods have demonstrated superior performance compared to other methods in capturing the interdependencies of log events. However, existing methods often neglect the complex substructure patterns of nodes within log graphs, making it challenging to capture the subtle alteration in event type, structure, and the location of exceptions that indicate node anomalies. To address this limitation, this paper proposes a novel framework called Substructure-aware Log Anomaly Detection at Code File Level (SLAD). It first introduces a Monte Carlo Tree Search strategy tailored specifically for log anomaly detection to discover representative substructures. Then, SLAD incorporates a substructure distillation way to enhance the efficiency of anomaly inference based on the representative substructures. After that, we introduce a soft pruning to obtain key substructure for nodes. Experimental results show SLAD outperforms all baselines. Particularly, SLAD demonstrates at least 15 times faster than substructure-based graph learning methods in anomaly inference.<\/jats:p>","DOI":"10.14778\/3705829.3705840","type":"journal-article","created":{"date-parts":[[2025,2,28]],"date-time":"2025-02-28T23:21:06Z","timestamp":1740784866000},"page":"213-225","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":4,"title":["Substructure-Aware Log Anomaly Detection"],"prefix":"10.14778","volume":"18","author":[{"given":"Yanni","family":"Tang","sequence":"first","affiliation":[{"name":"The University of Auckland, New Zealand"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhuoxing","family":"Zhang","sequence":"additional","affiliation":[{"name":"The University of Auckland, New Zealand"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kaiqi","family":"Zhao","sequence":"additional","affiliation":[{"name":"The University of Auckland, New Zealand"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lanting","family":"Fang","sequence":"additional","affiliation":[{"name":"Southeast University, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhenhua","family":"Li","sequence":"additional","affiliation":[{"name":"Southwest University, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wu","family":"Chen","sequence":"additional","affiliation":[{"name":"Southwest University, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2025,2,28]]},"reference":[{"key":"e_1_2_1_1_1","first-page":"2625","article-title":"Weisfeiler and lehman go cellular: Cw networks","volume":"34","author":"Bodnar Cristian","year":"2021","unstructured":"Cristian Bodnar, Fabrizio Frasca, Nina Otter, Yuguang Wang, Pietro Lio, Guido F Montufar, and Michael Bronstein. 2021. Weisfeiler and lehman go cellular: Cw networks. Advances in Neural Information Processing Systems 34 (2021), 2625--2640.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3154319"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE5003.2020.00013"},{"key":"e_1_2_1_4_1","volume-title":"Can graph neural networks count substructures? Advances in neural information processing systems 33","author":"Chen Zhengdao","year":"2020","unstructured":"Zhengdao Chen, Lei Chen, Soledad Villar, and Joan Bruna. 2020. Can graph neural networks count substructures? Advances in neural information processing systems 33 (2020), 10383--10395."},{"key":"e_1_2_1_5_1","first-page":"2243","article-title":"A-MCTS: adaptive monte carlo tree search for temporal path discovery","volume":"35","author":"Ding Pengfei","year":"2021","unstructured":"Pengfei Ding, Guanfeng Liu, Yan Wang, Kai Zheng, and Xiaofang Zhou. 2021. A-MCTS: adaptive monte carlo tree search for temporal path discovery. IEEE Transactions on Knowledge and Data Engineering 35, 3 (2021), 2243--2257.","journal-title":"IEEE Transactions on Knowledge and Data Engineering"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134015"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/3543507.3583268"},{"key":"e_1_2_1_8_1","volume-title":"Logbert: Log anomaly detection via bert. In 2021 international joint conference on neural networks (IJCNN)","author":"Guo Haixuan","year":"2021","unstructured":"Haixuan Guo, Shuhan Yuan, and Xintao Wu. 2021. Logbert: Log anomaly detection via bert. In 2021 international joint conference on neural networks (IJCNN). IEEE, 1--8."},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3053371"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2017.2762673"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.14778\/3554821.3554880"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE5003.2020.00018"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2007.46"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/2889160.2889232"},{"key":"e_1_2_1_15_1","volume-title":"TP-GNN: Continuous Dynamic Graph Neural Network for Graph Classification. IEEE 40th International Conference on Data Engineering (ICDE)","author":"Liu Jie","year":"2024","unstructured":"Jie Liu, Yanni Tang, Kaiqi Zhao, Jiamou Liu, and Wu Chen. 2024. TP-GNN: Continuous Dynamic Graph Neural Network for Graph Classification. IEEE 40th International Conference on Data Engineering (ICDE) (2024)."},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2843336"},{"key":"e_1_2_1_17_1","volume-title":"2010 USENIX Annual Technical Conference (USENIX ATC 10)","author":"Lou Jian-Guang","year":"2010","unstructured":"Jian-Guang Lou, Qiang Fu, Shenqi Yang, Ye Xu, and Jiang Li. 2010. Mining invariants from console logs for system problem detection. In 2010 USENIX Annual Technical Conference (USENIX ATC 10)."},{"key":"e_1_2_1_18_1","first-page":"4739","article-title":"Loganomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs","volume":"19","author":"Meng Weibin","year":"2019","unstructured":"Weibin Meng, Ying Liu, Yichen Zhu, Shenglin Zhang, Dan Pei, Yuqing Liu, Yihao Chen, Ruizhi Zhang, Shimin Tao, Pei Sun, et al. 2019. Loganomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs.. In IJCAI, Vol. 19. 4739--4745.","journal-title":"IJCAI"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM50108.2020.00148"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2020.07.008"},{"key":"e_1_2_1_21_1","first-page":"133","article-title":"Real-time Log File Analysis Using the Simple Event Correlator (SEC)","volume":"4","author":"Rouillard John P","year":"2004","unstructured":"John P Rouillard. 2004. Real-time Log File Analysis Using the Simple Event Correlator (SEC).. In LISA, Vol. 4. 133--150.","journal-title":"LISA"},{"key":"e_1_2_1_22_1","volume-title":"ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 8523--8527","author":"Sandfelder Dylan","year":"2021","unstructured":"Dylan Sandfelder, Priyesh Vijayan, and William L Hamilton. 2021. Ego-gnns: Exploiting ego structures in graph neural networks. In ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 8523--8527."},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/214"},{"key":"e_1_2_1_24_1","doi-asserted-by":"crossref","unstructured":"David Silver Julian Schrittwieser Karen Simonyan Ioannis Antonoglou Aja Huang Arthur Guez Thomas Hubert Lucas Baker Matthew Lai Adrian Bolton et al. 2017. Mastering the game of go without human knowledge. nature 550 7676 (2017) 354--359.","DOI":"10.1038\/nature24270"},{"key":"e_1_2_1_25_1","volume-title":"Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, IJCAI. 2233--2240","author":"Sun Yifei","year":"2022","unstructured":"Yifei Sun, Haoran Deng, Yang Yang, Chunping Wang, Jiarong Xu, Renhong Huang, Linfeng Cao, Yang Wang, and Lei Chen. 2022. Beyond homophily: structure-aware path aggregation graph neural network. In Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, IJCAI. 2233--2240."},{"key":"e_1_2_1_26_1","volume-title":"International Conference on Machine Learning. PMLR, 21076--21089","author":"Tang Jianheng","year":"2022","unstructured":"Jianheng Tang, Jiajin Li, Ziqi Gao, and Jia Li. 2022. Rethinking graph neural networks for anomaly detection. In International Conference on Machine Learning. PMLR, 21076--21089."},{"key":"e_1_2_1_27_1","volume-title":"Attention is all you need. Advances in neural information processing systems 30","author":"Vaswani Ashish","year":"2017","unstructured":"Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, \u0141ukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. Advances in neural information processing systems 30 (2017)."},{"key":"e_1_2_1_28_1","volume-title":"Graph attention networks. arXiv preprint arXiv:1710.10903","author":"Veli\u010dkovi\u0107 Petar","year":"2017","unstructured":"Petar Veli\u010dkovi\u0107, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Lio, and Yoshua Bengio. 2017. Graph attention networks. arXiv preprint arXiv:1710.10903 (2017)."},{"key":"e_1_2_1_29_1","volume-title":"Pacific-asia conference on knowledge discovery and data mining. Springer, 66--77","author":"Wan Yi","year":"2021","unstructured":"Yi Wan, Yilin Liu, Dong Wang, and Yujin Wen. 2021. Glad-paw: Graph-based log anomaly detection by position aware weighted graph attention network. In Pacific-asia conference on knowledge discovery and data mining. Springer, 66--77."},{"key":"e_1_2_1_30_1","volume-title":"2022 IEEE 22nd International Conference on Software Quality, Reliability and Security (QRS). IEEE, 299--310","author":"Xie Yongzheng","year":"2022","unstructured":"Yongzheng Xie, Hongyu Zhang, and Muhammad Ali Babar. 2022. LogGD: Detecting Anomalies from System Logs with Graph Neural Networks. In 2022 IEEE 22nd International Conference on Software Quality, Reliability and Security (QRS). IEEE, 299--310."},{"key":"e_1_2_1_31_1","volume-title":"How powerful are graph neural networks? arXiv preprint arXiv:1810.00826","author":"Xu Keyulu","year":"2018","unstructured":"Keyulu Xu, Weihua Hu, Jure Leskovec, and Stefanie Jegelka. 2018. How powerful are graph neural networks? arXiv preprint arXiv:1810.00826 (2018)."},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/1629575.1629587"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2023.119576"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE43902.2021.00130"},{"key":"e_1_2_1_35_1","volume-title":"Proceedings of the 29th annual computer security applications conference. 199--208","author":"Yen Ting-Fang","year":"2013","unstructured":"Ting-Fang Yen, Alina Oprea, Kaan Onarlioglu, Todd Leetham, William Robertson, Ari Juels, and Engin Kirda. 2013. Beehive: Large-scale log analysis for detecting suspicious activity in enterprise networks. In Proceedings of the 29th annual computer security applications conference. 199--208."},{"key":"e_1_2_1_36_1","volume-title":"Moving from Walks to Sets for Scalable Subgraph-based Graph Representation Learning. arXiv preprint arXiv:2303.03379","author":"Yin Haoteng","year":"2023","unstructured":"Haoteng Yin, Muhan Zhang, Jianguo Wang, and Pan Li. 2023. SUREL+: Moving from Walks to Sets for Scalable Subgraph-based Graph Representation Learning. arXiv preprint arXiv:2303.03379 (2023)."},{"key":"e_1_2_1_37_1","volume-title":"Algorithm and system co-design for efficient subgraph-based graph representation learning. arXiv preprint arXiv:2202.13538","author":"Yin Haoteng","year":"2022","unstructured":"Haoteng Yin, Muhan Zhang, Yanbang Wang, Jianguo Wang, and Pan Li. 2022. Algorithm and system co-design for efficient subgraph-based graph representation learning. arXiv preprint arXiv:2202.13538 (2022)."},{"key":"e_1_2_1_38_1","volume-title":"Proceedings of the AAAI Conference on Artificial Intelligence","volume":"37","author":"Zeng Dingyi","year":"2023","unstructured":"Dingyi Zeng, Wanlong Liu, Wenyu Chen, Li Zhou, Malu Zhang, and Hong Qu. 2023. Substructure aware graph neural networks. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 37. 11129--11137."},{"key":"e_1_2_1_39_1","volume-title":"Proceedings of the 44th International Conference on Software Engineering. 623--634","author":"Zhang Chenxi","year":"2022","unstructured":"Chenxi Zhang, Xin Peng, Chaofeng Sha, Ke Zhang, Zhenqing Fu, Xiya Wu, Qingwei Lin, and Dongmei Zhang. 2022. DeepTraLog: Trace-log combined microservice anomaly detection through graph-based deep learning. In Proceedings of the 44th International Conference on Software Engineering. 623--634."},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/3338906.3338931"},{"key":"e_1_2_1_41_1","volume-title":"Retgk: Graph kernels based on return probabilities of random walks. Advances in Neural Information Processing Systems 31","author":"Zhang Zhen","year":"2018","unstructured":"Zhen Zhang, Mianzhi Wang, Yijian Xiang, Yan Huang, and Arye Nehorai. 2018. Retgk: Graph kernels based on return probabilities of random walks. Advances in Neural Information Processing Systems 31 (2018)."},{"key":"e_1_2_1_42_1","volume-title":"From stars to subgraphs: Uplifting any GNN with local structure awareness. arXiv preprint arXiv:2110.03753","author":"Zhao Lingxiao","year":"2021","unstructured":"Lingxiao Zhao, Wei Jin, Leman Akoglu, and Neil Shah. 2021. From stars to subgraphs: Uplifting any GNN with local structure awareness. arXiv preprint arXiv:2110.03753 (2021)."},{"key":"e_1_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2018.2887384"}],"container-title":["Proceedings of the VLDB Endowment"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.14778\/3705829.3705840","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,2,28]],"date-time":"2025-02-28T23:22:46Z","timestamp":1740784966000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.14778\/3705829.3705840"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,10]]},"references-count":43,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2024,10]]}},"alternative-id":["10.14778\/3705829.3705840"],"URL":"https:\/\/doi.org\/10.14778\/3705829.3705840","relation":{},"ISSN":["2150-8097"],"issn-type":[{"value":"2150-8097","type":"print"}],"subject":[],"published":{"date-parts":[[2024,10]]},"assertion":[{"value":"2025-02-28","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}