{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,13]],"date-time":"2026-02-13T23:06:15Z","timestamp":1771023975013,"version":"3.50.1"},"reference-count":46,"publisher":"Walter de Gruyter GmbH","issue":"2","license":[{"start":{"date-parts":[[2026,2,9]],"date-time":"2026-02-09T00:00:00Z","timestamp":1770595200000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,3,1]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>The goal of log anomaly detection is to accurately detect system anomalies from logs. Traditional methods often suffer from insufficient generalization and delayed anomaly detection when dealing with semantically diverse and loosely structured log data. As the complexity of the system increases, the size of the logs is getting larger and larger, and it has become impractical to analyze them manually. To this end, this paper proposes FRLog, a log anomaly detection framework based on large language model, which realizes contextualized semantic embeddings of log sequences by fusing BERT and LLaMA models, thereby enabling more accurate log anomaly detection. Meanwhile, the parameter fine-tuning strategy ReFT is introduced, and the semantic bootstrapping, representation alignment and global tuning process are optimized by a three-phase collaborative training mechanism. Experimental results on three typical log datasets, BGL, HDFS and Thunderbird, show that FRLog outperforms the existing mainstream methods in terms of F1, Precision and Recall, especially in complex scenarios, demonstrating stronger anomaly discrimination and sample efficiency, which verifies its superiority and robustness in the log anomaly detection task.<\/jats:p>","DOI":"10.2478\/jaiscr-2026-0007","type":"journal-article","created":{"date-parts":[[2026,2,13]],"date-time":"2026-02-13T17:08:47Z","timestamp":1771002527000},"page":"125-144","source":"Crossref","is-referenced-by-count":0,"title":["FRLog: Log Anomaly Detection Based on Three-Stage Training with Reft Fine-Tuning for Large Language Model"],"prefix":"10.2478","volume":"16","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-6613-5711","authenticated-orcid":false,"given":"Keyuan","family":"Qiu","sequence":"first","affiliation":[{"name":"College of Information Science and Technology , Shihezi University , No. 221, Beisi Road , Shihezi City , , Xinjiang Uygur Autonomous Region , China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-7851-8032","authenticated-orcid":false,"given":"Zhejie","family":"Xu","sequence":"additional","affiliation":[{"name":"College of Information Science and Technology , Shihezi University , No. 221, Beisi Road , Shihezi City , , Xinjiang Uygur Autonomous Region , China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-3223-626X","authenticated-orcid":false,"given":"Tao","family":"Luo","sequence":"additional","affiliation":[{"name":"College of Information Science and Technology , Shihezi University , No. 221, Beisi Road , Shihezi City , , Xinjiang Uygur Autonomous Region , China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-1192-4216","authenticated-orcid":false,"given":"Meifang","family":"Yan","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology , Xinjiang Normal University , 102 Xinyi Road , Urumqi City , , Xinjiang Uygur Autonomous Region , China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-4822-4399","authenticated-orcid":false,"given":"Ruru","family":"Liu","sequence":"additional","affiliation":[{"name":"College of Artificial Intelligence , Jilin University , No. 2699, Qianjin Street , Changchun City , , Jilin Province , China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-6404-0560","authenticated-orcid":false,"given":"Pengjin","family":"Liu","sequence":"additional","affiliation":[{"name":"College of Information Science and Technology , Shihezi University , No. 221, Beisi Road , Shihezi City , , Xinjiang Uygur Autonomous Region , China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-1943-9094","authenticated-orcid":false,"given":"Feng","family":"Chen","sequence":"additional","affiliation":[{"name":"College of Information Science and Technology , Shihezi University , No. 221, Beisi Road , Shihezi City , , Xinjiang Uygur Autonomous Region , China"}]}],"member":"374","published-online":{"date-parts":[[2026,2,9]]},"reference":[{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_001","unstructured":"Jia Tong, Li Ying, Wu Zhonghai. Review of fault diagnosis of distributed software system based on log data. Journal of Software, 2020, 31(7): 1997\u20132018."},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_002","doi-asserted-by":"crossref","unstructured":"Qiu K, Zhang Y, Chen F. MSM: point cloud alignment algorithm through multi-scale feature fusion and cross-attention mechanism. Intelligent Service Robotics, 2025: 1\u201317.","DOI":"10.1007\/s11370-025-00594-1"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_003","doi-asserted-by":"crossref","unstructured":"Qiu K, Zhang Y, Zhao J, et al. A Multimodal Sentiment Analysis Approach Based on a Joint Chained Interactive Attention Mechanism. Electronics, 2024, 13(10): 1922.","DOI":"10.3390\/electronics13101922"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_004","doi-asserted-by":"crossref","unstructured":"Qiu K, Zhang Y, Ren Z, et al. SpemNet: A Cotton Disease and Pest Identification Method Based on Efficient Multi-Scale Attention and Stacking Patch Embedding. Insects, 2024, 15(9): 667.","DOI":"10.3390\/insects15090667"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_005","doi-asserted-by":"crossref","unstructured":"Qiu K, Yan M, Luo T, et al. FedAware: a distributed IoT intrusion detection method based on fractal shrinking autoencoder. Journal of King Saud University - Computer and Information Sciences, 2025, 37(7): 1\u201321.","DOI":"10.1007\/s44443-025-00153-9"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_006","doi-asserted-by":"crossref","unstructured":"Guo H, Yuan S, Wu X. Logbert: Log anomaly detection via BERT. In: Proc. of IJCNN, IEEE, 2021: 1\u20138.","DOI":"10.1109\/IJCNN52387.2021.9534113"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_007","doi-asserted-by":"crossref","unstructured":"Le V H, Zhang H. Log-based anomaly detection without log parsing. In: ASE, IEEE, 2021: 492\u2013504.","DOI":"10.1109\/ASE51524.2021.9678773"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_008","unstructured":"Devlin J, Chang M W, Lee K, et al. BERT: Pre-training of deep bidirectional transformers for language understanding,2018. http:\/\/arxiv.org\/abs\/1810.04805"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_009","unstructured":"Vaswani A, Shazeer N, Parmar N, et al. Attention is all you need. In: Advances in Neural Information Processing Systems, 2017."},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_010","doi-asserted-by":"crossref","unstructured":"He S, Zhu J, He P, et al. Experience report: system log analysis for anomaly detection. In: ISSRE, IEEE, 2016.","DOI":"10.1109\/ISSRE.2016.21"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_011","doi-asserted-by":"crossref","unstructured":"Xu W, Huang L, Fox A, et al. Detecting large-scale system problems by mining console logs. In: SOSP, ACM, 2009.","DOI":"10.1145\/1629575.1629587"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_012","doi-asserted-by":"crossref","unstructured":"Lin Q, Zhang H, Lou J G, et al. Log clustering based problem identification for online service systems. In: ICSE-C, ACM, 2016.","DOI":"10.1145\/2889160.2889232"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_013","doi-asserted-by":"crossref","unstructured":"Liang Y, Zhang Y, Xiong H, et al. Failure prediction in IBM BlueGene\/L event logs. In: ICDM, IEEE, 2007.","DOI":"10.1109\/ICDM.2007.46"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_014","doi-asserted-by":"crossref","unstructured":"Bodik P, Goldszmidt M, Fox A, et al. Fingerprinting the datacenter: automated classification of performance crises. In: EuroSys, ACM, 2010.","DOI":"10.1145\/1755913.1755926"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_015","unstructured":"Chen M, Zheng A X, Lloyd J, et al. Failure diagnosis using decision trees. In: Autonomic Computing, IEEE, 2004."},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_016","doi-asserted-by":"crossref","unstructured":"Liu Z, Qin T, Guan X, Jiang H, Wang C. An integrated method for anomaly detection from massive system logs. IEEE Access, 2018, 6: 30602\u201330611.","DOI":"10.1109\/ACCESS.2018.2843336"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_017","doi-asserted-by":"crossref","unstructured":"Elmrabit N, Yang S, Yang L, Zhou H. Insider threat risk prediction based on Bayesian network. Computers & Security, 2020, 96: 101908.","DOI":"10.1016\/j.cose.2020.101908"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_018","doi-asserted-by":"crossref","unstructured":"d\u2019Ambrosio N, Perrone G, Romano S.P. Including insider threats into risk management through Bayesian threat graph networks. Computers & Security, 2023, 133: 103410.","DOI":"10.1016\/j.cose.2023.103410"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_019","doi-asserted-by":"crossref","unstructured":"Rashid T, Agrafiotis I, Nurse J R C. A new take on detecting insider threats: Exploring the use of hidden Markov models. In: MIST, ACM, 2016: 47\u201356.","DOI":"10.1145\/2995959.2995964"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_020","doi-asserted-by":"crossref","unstructured":"Ye X, Han M. An improved feature extraction algorithm for insider threat using hidden Markov model on user behavior detection. Information & Computer Security, 2022, 30(1): 19\u201336.","DOI":"10.1108\/ICS-12-2019-0142"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_021","doi-asserted-by":"crossref","unstructured":"Liu F T, Ting K M, Zhou Z-H. Isolation-based anomaly detection. ACM Trans. Knowl. Discov. Data, 2012, 6(1): 1\u201339.","DOI":"10.1145\/2133360.2133363"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_022","doi-asserted-by":"crossref","unstructured":"Ding Z, Fei M. An anomaly detection approach based on isolation forest algorithm for streaming data using sliding window. IFAC Proc. Vol., 2013, 46(20): 12\u201317.","DOI":"10.3182\/20130902-3-CN-3020.00044"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_023","doi-asserted-by":"crossref","unstructured":"Karev D, McCubbin C, Vaulin R. Cyber threat hunting through the use of an isolation forest. In: CompSysTech, 2017: 163\u2013170.","DOI":"10.1145\/3134302.3134319"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_024","doi-asserted-by":"crossref","unstructured":"Du M, Li F, Zheng G, et al. DeepLog: anomaly detection and diagnosis from system logs through deep learning. In: CCS, ACM, 2017.","DOI":"10.1145\/3133956.3134015"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_025","doi-asserted-by":"crossref","unstructured":"Liu F, Wen Y, Zhang D, et al. Log2vec: a heterogeneous graph embedding based approach for detecting cyber threats within enterprise. In: CCS, ACM, 2019.","DOI":"10.1145\/3319535.3363224"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_026","unstructured":"Sasaki S, Suzuki J, Inui K. Subword-based compact reconstruction of word embeddings. In: NAACL-HLT, ACL, 2019."},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_027","doi-asserted-by":"crossref","unstructured":"Wang J, Yu L C, Lai K R, et al. Dimensional sentiment analysis using a regional CNN-LSTM model. In: ACL, 2016.","DOI":"10.18653\/v1\/P16-2037"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_028","doi-asserted-by":"crossref","unstructured":"Luo L X. Network text sentiment analysis method combining LDA text representation and GRUCNN. Pers Ubiquit Comput, 2019, 23: 405.","DOI":"10.1007\/s00779-018-1183-9"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_029","doi-asserted-by":"crossref","unstructured":"Yu H, Yang J. A direct LDA algorithm for high-dimensional data\u2014application to face recognition. Pattern Recognition, 2001, 34: 2067.","DOI":"10.1016\/S0031-3203(00)00162-X"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_030","doi-asserted-by":"crossref","unstructured":"Xiao T, Quan Z, Wang Z J, et al. Loader: A log anomaly detector based on transformer. IEEE Trans. Serv. Comput., 2023, 16(5): 3479\u20133492.","DOI":"10.1109\/TSC.2023.3280575"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_031","doi-asserted-by":"crossref","unstructured":"Guo H, Yuan S, Wu X. Logbert: Log anomaly detection via BERT. In: IJCNN, IEEE, 2021: 1\u20138.","DOI":"10.1109\/IJCNN52387.2021.9534113"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_032","unstructured":"Yu J, Hu Z, Jiang C. Multi-feature-based log event anomaly detection. Computer Engineering and Science, 2024, 46(09): 1587\u20131597."},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_033","doi-asserted-by":"crossref","unstructured":"Qiu K, Zhang Y, Feng Y, et al. LogAnomEX: An Unsupervised Log Anomaly Detection Method Based on Electra-DP and Gated Bilinear Neural Networks. Journal of Network and Systems Management, 2025, 33(2): 1\u201329.","DOI":"10.1007\/s10922-025-09912-5"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_034","doi-asserted-by":"crossref","unstructured":"Qi J, Huang S, Luan Z, et al. LogGPT: Exploring ChatGPT for log-based anomaly detection. In: HPCC\/DSS\/SmartCity\/DependSys, IEEE, 2023: 273\u2013280.","DOI":"10.1109\/HPCC-DSS-SmartCity-DependSys60770.2023.00045"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_035","doi-asserted-by":"crossref","unstructured":"He M, Jia T, Duan C, et al. LLMeLog: An Approach for Anomaly Detection based on LLM-enriched Log Events. In: ISSRE, IEEE, 2024: 132\u2013143.","DOI":"10.1109\/ISSRE62328.2024.00023"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_036","doi-asserted-by":"crossref","unstructured":"Han X, Yuan S, Trabelsi M. LogGPT: Log anomaly detection via GPT. In: BigData, IEEE, 2023: 1117\u20131122.","DOI":"10.1109\/BigData59044.2023.10386543"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_037","unstructured":"Hadadi F, Xu Q, Bianculli D, et al. Anomaly detection on unstable logs with GPT models. arXiv preprint arXiv:2406.07467, 2024."},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_038","unstructured":"Guan W, Cao J, Qian S, et al. LogLLM: Log-based Anomaly Detection Using Large Language Models. arXiv preprint arXiv:2411.08561, 2024."},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_039","doi-asserted-by":"crossref","unstructured":"Lim Y F, Zhu J, Pang G. Adapting Large Language Models for Parameter-Efficient Log Anomaly Detection. arXiv preprint arXiv:2503.08045, 2025.","DOI":"10.1007\/978-981-96-8298-0_26"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_040","doi-asserted-by":"crossref","unstructured":"Nasser H, Trad F, Chehab A. Stacking Large Language Models is All You Need: A Case Study on Phishing URL Detection. Journal of Artificial Intelligence and Soft Computing Research, 2025, 15(4): 337\u2013356.","DOI":"10.2478\/jaiscr-2025-0017"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_041","doi-asserted-by":"crossref","unstructured":"Romaszewski M, Seku\u0142a P, G\u0142omb P, et al. Through the Thicket: A Study of Number-Oriented LLMs Derived from Random Forest Models. Journal of Artificial Intelligence and Soft Computing Research, 2025, 15(3): 279\u2013298.","DOI":"10.2478\/jaiscr-2025-0014"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_042","doi-asserted-by":"crossref","unstructured":"Oliner A J, Stearley J. What Supercomputers Say: A Study of Five System Logs. In: DSN, IEEE\/IFIP, 2007.","DOI":"10.1109\/DSN.2007.103"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_043","doi-asserted-by":"crossref","unstructured":"Zhu J, He S, He P, et al. Loghub: A Large Collection of System Log Datasets for AI-driven Log Analytics. In: ISSRE, IEEE, 2023.","DOI":"10.1109\/ISSRE59848.2023.00071"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_044","doi-asserted-by":"crossref","unstructured":"Xu W, Huang L, Fox A, et al. Detecting Large-Scale System Problems by Mining Console Logs. In: SOSP, ACM, 2009.","DOI":"10.1145\/1629575.1629587"},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_045","unstructured":"Lin Y, Deng H, Li X. FastLogAD: Log Anomaly Detection with Mask-Guided Pseudo Anomaly Generation and Discrimination. arXiv preprint arXiv:2404.08750, 2024."},{"key":"2026021322101126097_j_jaiscr-2026-0007_ref_046","doi-asserted-by":"crossref","unstructured":"Li Z, Shi J, Van Leeuwen M. Graph neural networks based log anomaly detection and explanation. In: ICSE Companion, IEEE\/ACM, 2024: 306\u2013307.","DOI":"10.1145\/3639478.3643084"}],"container-title":["Journal of Artificial Intelligence and Soft Computing Research"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.sciendo.com\/pdf\/10.2478\/jaiscr-2026-0007","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,13]],"date-time":"2026-02-13T22:10:25Z","timestamp":1771020625000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.sciendo.com\/article\/10.2478\/jaiscr-2026-0007"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,2,9]]},"references-count":46,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2026,2,9]]},"published-print":{"date-parts":[[2026,3,1]]}},"alternative-id":["10.2478\/jaiscr-2026-0007"],"URL":"https:\/\/doi.org\/10.2478\/jaiscr-2026-0007","relation":{},"ISSN":["2449-6499"],"issn-type":[{"value":"2449-6499","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,2,9]]}}}