{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,2]],"date-time":"2026-05-02T06:58:21Z","timestamp":1777705101847,"version":"3.51.4"},"reference-count":38,"publisher":"SAGE Publications","issue":"4","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IFS"],"published-print":{"date-parts":[[2024,4,18]]},"abstract":"<jats:p>With the development of artificial intelligence, deep-learning-based log anomaly detection proves to be an important research topic. In this paper, we propose LogCSS, a novel log anomaly detection framework based on the Context-Semantics-Statistics Convolutional Neural Network (CSSCNN). It is the first model that uses BERT (Bidirectional Encoder Representation from Transformers) and CNN (Convolutional Neural Network) to extract the semantic, temporal, and correlational features of the logs. We combine the features with the statistic information of log templates for the classification model to improve the accuracy. We also propose a technique, DOOT (Deals with the Out-Of-Templates), for online template matching. The experimental research shows that our framework improves the average F1 score of the six best algorithms in the industry by more than 5% on the open-source dataset HDFS, and improves the average F1 score of the six best algorithms in the industry by more than 8% on the BGL dataset, LogCSS also performs better than other similar methods on our own constructed dataset.<\/jats:p>","DOI":"10.3233\/jifs-235801","type":"journal-article","created":{"date-parts":[[2024,2,6]],"date-time":"2024-02-06T13:06:18Z","timestamp":1707224778000},"page":"7659-7676","source":"Crossref","is-referenced-by-count":0,"title":["LogCSS: Log anomaly detection based on BERT-CNN with context-semantics-statistics features"],"prefix":"10.1177","volume":"46","author":[{"given":"Zhongliang","family":"Li","sequence":"first","affiliation":[{"name":"College of Computer Science & Technology, Nanjing University of Aeronautics and Astronautics, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xuezhen","family":"Tu","sequence":"additional","affiliation":[{"name":"College of Computer Science & Technology, Nanjing University of Aeronautics and Astronautics, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hong","family":"Gao","sequence":"additional","affiliation":[{"name":"College of Computer Science & Technology, Nanjing University of Aeronautics and Astronautics, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Shiyue","family":"Huang","sequence":"additional","affiliation":[{"name":"School of Computer Science, Peking University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zongmin","family":"Ma","sequence":"additional","affiliation":[{"name":"College of Computer Science & Technology, Nanjing University of Aeronautics and Astronautics, Nanjing, China"},{"name":"Collaborative Innovation Center of Novel Software Technology and Industrialization, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"179","reference":[{"key":"10.3233\/JIFS-235801_ref1","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2016.21"},{"key":"10.3233\/JIFS-235801_ref2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134015"},{"key":"10.3233\/JIFS-235801_ref3","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1810.04805"},{"key":"10.3233\/JIFS-235801_ref4","doi-asserted-by":"publisher","DOI":"10.1109\/ISMSIT.2019.8932888"},{"issue":"3","key":"10.3233\/JIFS-235801_ref5","doi-asserted-by":"publisher","first-page":"229","DOI":"10.1016\/j.icte.2020.06.003","article-title":"Unsupervised log message anomaly detection","volume":"6","author":"Farzad","year":"2020","journal-title":"ICT Express"},{"key":"10.3233\/JIFS-235801_ref6","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2014.79"},{"key":"10.3233\/JIFS-235801_ref7","doi-asserted-by":"publisher","DOI":"10.1109\/IGARSS.2019.8899812"},{"key":"10.3233\/JIFS-235801_ref8","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM.2016.7795458"},{"key":"10.3233\/JIFS-235801_ref9","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019%2F658"},{"key":"10.3233\/JIFS-235801_ref10","doi-asserted-by":"publisher","DOI":"10.1145\/1755913.1755926"},{"issue":"1","key":"10.3233\/JIFS-235801_ref14","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3292040.3219643","article-title":"Prefix: Switch failure prediction in datacenter networks","volume":"2","author":"Zhang","year":"2018","journal-title":"Proceedings of the ACM on Measurement and Analysis of Computing Systems"},{"key":"10.3233\/JIFS-235801_ref15","doi-asserted-by":"publisher","DOI":"10.1145\/2815675.2815679"},{"key":"10.3233\/JIFS-235801_ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3338906.3338931"},{"key":"10.3233\/JIFS-235801_ref17","doi-asserted-by":"publisher","DOI":"10.1109\/ASE51524.2021.9678773"},{"key":"10.3233\/JIFS-235801_ref18","doi-asserted-by":"publisher","first-page":"5998","DOI":"10.48550\/arXiv.1706.03762","article-title":"Attention is all you need","volume":"30","author":"Vaswani","year":"2017","journal-title":"Advances in Neural Information Processing Systems"},{"key":"10.3233\/JIFS-235801_ref19","doi-asserted-by":"publisher","first-page":"285","DOI":"10.1007\/s10796-020-10026-3","article-title":"Loggan: a log-level generative adversarial network for anomaly detection using permutation event modeling","volume":"23","author":"Xia","year":"2021","journal-title":"Information Systems Frontiers"},{"key":"10.3233\/JIFS-235801_ref20","doi-asserted-by":"publisher","DOI":"10.1109\/ICWS.2017.13"},{"issue":"2","key":"10.3233\/JIFS-235801_ref21","doi-asserted-by":"publisher","first-page":"1870","DOI":"10.1109\/TNSM.2021.3055425","article-title":"Logclass: Anomalous log identification and classification with partial labels","volume":"18","author":"Meng","year":"2021","journal-title":"IEEE Transactions on Network and Service Management"},{"key":"10.3233\/JIFS-235801_ref22","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1609.08144"},{"key":"10.3233\/JIFS-235801_ref23","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1910.01108"},{"key":"10.3233\/JIFS-235801_ref24","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2003.10555"},{"key":"10.3233\/JIFS-235801_ref26","doi-asserted-by":"publisher","DOI":"10.1111\/j.1467-968X.2005.00157.x"},{"key":"10.3233\/JIFS-235801_ref27","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE52982.2021.00023"},{"key":"10.3233\/JIFS-235801_ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363224"},{"key":"10.3233\/JIFS-235801_ref30","doi-asserted-by":"publisher","first-page":"1091","DOI":"10.1016\/j.scitotenv.2018.11.086","article-title":"A novel spatiotemporal convolutional long short-term neural network for air pollution prediction","volume":"654","author":"Wen","year":"2019","journal-title":"Science of the Total Environment"},{"key":"10.3233\/JIFS-235801_ref31","doi-asserted-by":"publisher","first-page":"324","DOI":"10.1016\/j.ijepes.2014.12.005","article-title":"Design andevaluation of a hybrid system for detection and prediction of faultsin electrical transformers","volume":"67","author":"Al-Janabi","year":"2015","journal-title":"International Journal of ElectricalPower & Energy Systems"},{"issue":"21","key":"10.3233\/JIFS-235801_ref32","doi-asserted-by":"publisher","first-page":"14199","DOI":"10.1007\/s00521-021-06067-7","article-title":"Intelligent forecaster of concentrations (PM2. 5, PM10, NO2, CO, O3, SO2) caused air pollution (IFCsAP)","volume":"33","author":"Al-Janabi","year":"2021","journal-title":"Neural Computing and Applications"},{"issue":"14","key":"10.3233\/JIFS-235801_ref33","doi-asserted-by":"publisher","first-page":"10943","DOI":"10.1007\/s00500-020-04905-9","article-title":"An Innovative synthesis ofdeep learning techniques (DCapsNet & DCOM) for generationelectrical renewable energy from wind energy","volume":"24","author":"Al-Janabi","year":"2020","journal-title":"Soft Computing"},{"key":"10.3233\/JIFS-235801_ref34","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1155\/2017\/8728209","article-title":"Introducing a novel hybrid artificial intelligence algorithm to optimize network of industrial applications in modern manufacturing","volume":"2017","author":"Azizi","year":"2017","journal-title":"Complexity"},{"key":"10.3233\/JIFS-235801_ref35","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1155\/2020\/8564140","article-title":"Applications of artificial intelligence techniques to enhance sustainability of industry 4.0: design of an artificial neural network model as dynamic behavior optimizer of robotic arms","volume":"2020","author":"Azizi","year":"2020","journal-title":"Complexity"},{"key":"10.3233\/JIFS-235801_ref37","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2019.8737430"},{"key":"10.3233\/JIFS-235801_ref41","doi-asserted-by":"publisher","first-page":"108616","DOI":"10.1016\/j.comnet.2021.108616","article-title":"LightLog: A lightweight temporal convolutional network for log anomaly detection on the edge","volume":"203","author":"Wang","year":"2022","journal-title":"Computer Networks"},{"key":"10.3233\/JIFS-235801_ref42","doi-asserted-by":"publisher","first-page":"390","DOI":"10.1016\/j.future.2021.05.024","article-title":"LogNADS: Network anomaly detection scheme based on log semantics representation","volume":"124","author":"Liu","year":"2021","journal-title":"Future Generation Computer Systems"},{"issue":"3","key":"10.3233\/JIFS-235801_ref43","doi-asserted-by":"publisher","first-page":"102540","DOI":"10.1016\/j.ipm.2021.102540","article-title":"QLLog: A log anomalydetection method based on Q-learning algorithm","volume":"58","author":"Duan","year":"2021","journal-title":"InformationProcessing & Management"},{"key":"10.3233\/JIFS-235801_ref44","doi-asserted-by":"publisher","first-page":"116263","DOI":"10.1016\/j.eswa.2021.116263","article-title":"AutoLog: Anomaly detection by deep autoencoding of system logs","volume":"191","author":"Catillo","year":"2022","journal-title":"Expert Systems with Applications"},{"key":"10.3233\/JIFS-235801_ref45","doi-asserted-by":"publisher","first-page":"107433","DOI":"10.1016\/j.compeleceng.2021.107433","article-title":"Anomaly detection on software log based on Temporal Memory","volume":"95","author":"Hirakawa","year":"2021","journal-title":"Computers and Electrical Engineering"},{"key":"10.3233\/JIFS-235801_ref46","doi-asserted-by":"publisher","DOI":"10.23919\/CNSM55787.2022.9965187"},{"key":"10.3233\/JIFS-235801_ref47","doi-asserted-by":"crossref","first-page":"110689","DOI":"10.1016\/j.asoc.2023.110689","article-title":"LAnoBERT: System log anomaly detection based on BERT masked language model","volume":"146","author":"Lee","year":"2023","journal-title":"Appl. Soft Comput"}],"container-title":["Journal of Intelligent &amp; Fuzzy Systems"],"original-title":[],"link":[{"URL":"https:\/\/content.iospress.com\/download?id=10.3233\/JIFS-235801","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T09:42:54Z","timestamp":1777455774000},"score":1,"resource":{"primary":{"URL":"https:\/\/journals.sagepub.com\/doi\/full\/10.3233\/JIFS-235801"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,4,18]]},"references-count":38,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.3233\/jifs-235801","relation":{},"ISSN":["1064-1246","1875-8967"],"issn-type":[{"value":"1064-1246","type":"print"},{"value":"1875-8967","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,4,18]]}}}