{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,24]],"date-time":"2026-04-24T14:47:55Z","timestamp":1777042075429,"version":"3.51.4"},"reference-count":33,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2026,2,27]],"date-time":"2026-02-27T00:00:00Z","timestamp":1772150400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>Operational logs are a central information source for monitoring and diagnosing complex information systems, yet the effect of log-sequence representation on anomaly detection remains underexplored. This paper investigates three families of sequence embeddings, E1 (template-ID lookup), E2 (semantic), and E3 (hybrid), for log-based anomaly detection. Each embedding is paired with CNN, LSTM, and Transformer heads under a unified training protocol. We conduct controlled experiments on diverse public corpora to assess in-domain and cross-dataset generalization. We report PR\u2013AUC (primary), AUROC, F1, and precision at recall \u22650.9, with 95% bootstrap confidence intervals. Beyond accuracy, we analyze the impact of sequence length, parser choice, and out-of-vocabulary (OOV) rates at both token and template levels within and across datasets. The results suggest that representation choice can meaningfully influence detection performance, particularly under distribution shift. Open-vocabulary semantic and hybrid embeddings can improve robustness to OOV effects, but transfer gains are inconsistent, and degradation often persists under strict cross-dataset transfer.<\/jats:p>","DOI":"10.3390\/info17030228","type":"journal-article","created":{"date-parts":[[2026,2,27]],"date-time":"2026-02-27T15:52:38Z","timestamp":1772207558000},"page":"228","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Investigating the Impact of Log-Sequence Embeddings on Anomaly Detection: A Systematic Study"],"prefix":"10.3390","volume":"17","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6585-4483","authenticated-orcid":false,"given":"Musaad","family":"Alzahrani","sequence":"first","affiliation":[{"name":"Department of Computer Science, Al-Baha University, Al-Baha 65779, Saudi Arabia"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2026,2,27]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"105","DOI":"10.1007\/s10664-024-10501-4","article-title":"Systematic Evaluation of Deep Learning Models for Log-based Failure Prediction","volume":"29","author":"Hadadi","year":"2023","journal-title":"Empir. Softw. Eng."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Le, V.H., and Zhang, H. (2022, January 8\u201320). Log-based anomaly detection with deep learning: How far are we?. Proceedings of the 44th International Conference on Software Engineering, New York, NY, USA. ICSE \u201922.","DOI":"10.1145\/3510003.3510155"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3460345","article-title":"A Survey on Automated Log Analysis for Reliability Engineering","volume":"54","author":"He","year":"2021","journal-title":"ACM Comput. Surv."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"106024","DOI":"10.1016\/j.cie.2019.106024","article-title":"A systematic literature review of machine learning methods applied to predictive maintenance","volume":"137","author":"Carvalho","year":"2019","journal-title":"Comput. Ind. Eng."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"139","DOI":"10.1007\/s10664-024-10533-w","article-title":"Impact of log parsing on deep learning-based anomaly detection","volume":"29","author":"Khan","year":"2023","journal-title":"Empir. Softw. Eng."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Du, M., Li, F., Zheng, G., and Srikumar, V. (November, January 30). DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, New York, NY, USA. CCS \u201917.","DOI":"10.1145\/3133956.3134015"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Meng, W., Liu, Y., Zhu, Y., Zhang, S., Pei, D., Liu, Y., Chen, Y., Zhang, R., Tao, S., and Sun, P. (2019, January 10\u201316). LogAnomaly: Unsupervised Detection of Sequential and Quantitative Anomalies in Unstructured Logs. Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence, IJCAI-19. International Joint Conferences on Artificial Intelligence Organization, Macao, China.","DOI":"10.24963\/ijcai.2019\/658"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Zhang, X., Xu, Y., Lin, Q., Qiao, B., Zhang, H., Dang, Y., Xie, C., Yang, X., Cheng, Q., and Li, Z. (2019, January 26\u201330). Robust log-based anomaly detection on unstable log data. Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, New York, NY, USA. ESEC\/FSE 2019.","DOI":"10.1145\/3338906.3338931"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Yang, L., Chen, J., Wang, Z., Wang, W., Jiang, J., Dong, X., and Zhang, W. (2021). Semi-supervised Log-based Anomaly Detection via Probabilistic Label Estimation. Proceedings of the 43rd International Conference on Software Engineering, IEEE Press. ICSE \u201921.","DOI":"10.1109\/ICSE43902.2021.00130"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Lu, S., Wei, X., Li, Y., and Wang, L. (2018, January 12\u201315). Detecting Anomaly in Big Data System Logs Using Convolutional Neural Network. Proceedings of the 2018 IEEE 16th Intl Conf on Dependable, Autonomic and Secure Computing, 16th Intl Conf on Pervasive Intelligence and Computing, 4th Intl Conf on Big Data Intelligence and Computing and Cyber Science and Technology Congress(DASC\/PiCom\/DataCom\/CyberSciTech), Athens, Greece.","DOI":"10.1109\/DASC\/PiCom\/DataCom\/CyberSciTec.2018.00037"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Guo, H., Yuan, S., and Wu, X. (2021, January 18\u201322). LogBERT: Log Anomaly Detection via BERT. Proceedings of the 2021 International Joint Conference on Neural Networks (IJCNN), Shenzhen, China.","DOI":"10.1109\/IJCNN52387.2021.9534113"},{"key":"ref_12","first-page":"8596","article-title":"System Log Parsing: A Survey","volume":"35","author":"Zhang","year":"2023","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_13","unstructured":"Makanju, A.A., Zincir-Heywood, A.N., and Milios, E.E. (July, January 28). Clustering event logs using iterative partitioning. Proceedings of the 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, New York, NY, USA. KDD \u201909."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"He, P., Zhu, J., Zheng, Z., and Lyu, M.R. (2017, January 25\u201330). Drain: An Online Log Parsing Approach with Fixed Depth Tree. Proceedings of the 2017 IEEE International Conference on Web Services (ICWS), Honolulu, HI, USA.","DOI":"10.1109\/ICWS.2017.13"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"He, S., Zhu, J., He, P., and Lyu, M.R. (2016, January 23\u201327). Experience Report: System Log Analysis for Anomaly Detection. Proceedings of the 2016 IEEE 27th International Symposium on Software Reliability Engineering (ISSRE), Ottawa, ON, Canada.","DOI":"10.1109\/ISSRE.2016.21"},{"key":"ref_16","unstructured":"LogPAI (2025, November 01). Logparser: A Machine Learning Toolkit for Automated Log Parsing. GitHub Repository; Implements Drain, Spell, IPLoM, and Other Parsers. Available online: https:\/\/github.com\/logpai\/logparser."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Zhu, J., He, S., He, P., Liu, J., and Lyu, M.R. (2023, January 9\u201312). Loghub: A Large Collection of System Log Datasets for AI-driven Log Analytics. Proceedings of the IEEE International Symposium on Software Reliability Engineering (ISSRE), Florence, Italy.","DOI":"10.1109\/ISSRE59848.2023.00071"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Jiang, Z., Liu, J., Huang, J., Li, Y., Huo, Y., Gu, J., Chen, Z., Zhu, J., and Lyu, M.R. (2024, January 16\u201320). A Large-scale Evaluation for Log Parsing Techniques: How Far are We?. Proceedings of the ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), Vienna, Austria.","DOI":"10.1145\/3650212.3652123"},{"key":"ref_19","unstructured":"LogPAI (2025, November 01). Loglizer: A Machine Learning Toolkit for Log-based Anomaly Detection. GitHub Repository; Classic and Deep-learning Baselines for Log-Based Anomaly Detection. Available online: https:\/\/github.com\/logpai\/loglizer."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"1378","DOI":"10.1109\/TNSM.2023.3239522","article-title":"LogEncoder: Log-Based Contrastive Representation Learning for Anomaly Detection","volume":"20","author":"Qi","year":"2023","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_21","unstructured":"Yan, S., Wang, S., Chen, Z., Jiang, X., and Cao, X. (2023, January 6\u20138). CSLog: Anomaly Detection for Syslog Based on Contrastive Self-Supervised Representation Learning. Proceedings of the 2023 24st Asia-Pacific Network Operations and Management Symposium (APNOMS), Sejong, Republic of Korea."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Li, Z., Shi, J., and Van Leeuwen, M. (2024, January 14\u201320). Graph Neural Networks based Log Anomaly Detection and Explanation. Proceedings of the 2024 IEEE\/ACM 46th International Conference on Software Engineering: Companion Proceedings, New York, NY, USA. ICSE-Companion \u201924.","DOI":"10.1145\/3639478.3643084"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"2382","DOI":"10.1109\/TNSM.2025.3542595","article-title":"DRLLog: Deep Reinforcement Learning for Online Log Anomaly Detection","volume":"22","author":"Zhou","year":"2025","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_24","unstructured":"Yamanaka, Y., Takahashi, T., Minami, T., and Nakajima, Y. (2024). LogELECTRA: Self-supervised anomaly detection for unstructured logs. arXiv."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"2098","DOI":"10.1145\/3660800","article-title":"LogSD: Detecting Anomalies from System Logs through Self-Supervised Learning and Frequency-Based Masking","volume":"1","author":"Xie","year":"2024","journal-title":"Proc. ACM Softw. Eng."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Han, X., Yuan, S., and Trabelsi, M. (2023, January 15\u201318). LogGPT: Log Anomaly Detection via GPT. Proceedings of the 2023 IEEE International Conference on Big Data (BigData), Sorrento, Italy.","DOI":"10.1109\/BigData59044.2023.10386543"},{"key":"ref_27","unstructured":"Guan, W., Cao, J., Qian, S., Gao, J., and Ouyang, C. (2025). Logllm: Log-based anomaly detection using large language models. arXiv."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"114064","DOI":"10.1016\/j.knosys.2025.114064","article-title":"LLM-LADE: Large language model-based log anomaly detection with explanation","volume":"326","author":"Zhang","year":"2025","journal-title":"Knowl.-Based Syst."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Yang, Z., and Harris, I.G. (2025). LogLLaMA: Transformer-based log anomaly detection with LLaMA. arXiv.","DOI":"10.1109\/IJCNN64981.2025.11227209"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Luo, X., Jha, S.M.N., Sinha, A., Li, Z., and Liu, Y. (2025). ALPHA: LLM-Enabled Active Learning for Human-Free Network Anomaly Detection. arXiv.","DOI":"10.1109\/IPCCC66453.2025.11304694"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Oliner, A., and Stearley, J. (2007, January 25\u201328). What Supercomputers Say: A Study of Five System Logs. Proceedings of the 37th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN\u201907), Edinburgh, UK.","DOI":"10.1109\/DSN.2007.103"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Le, V.H., and Zhang, H. (2022). Log-based anomaly detection without log parsing. Proceedings of the 36th IEEE\/ACM International Conference on Automated Software Engineering, IEEE Press. ASE \u201921.","DOI":"10.1109\/ASE51524.2021.9678773"},{"key":"ref_33","unstructured":"Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, L., and Polosukhin, I. (2017, January 4\u20139). Attention is all you need. Proceedings of the 31st International Conference on Neural Information Processing Systems, Red Hook, NY, USA. NIPS\u201917."}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/17\/3\/228\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,4]],"date-time":"2026-03-04T13:33:54Z","timestamp":1772631234000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/17\/3\/228"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,2,27]]},"references-count":33,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2026,3]]}},"alternative-id":["info17030228"],"URL":"https:\/\/doi.org\/10.3390\/info17030228","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,2,27]]}}}