{"id":"https://openalex.org/W2102632804","doi":"https://doi.org/10.1109/icdm.2009.60","title":"Execution Anomaly Detection in Distributed Systems through Unstructured Log Analysis","display_name":"Execution Anomaly Detection in Distributed Systems through Unstructured Log Analysis","publication_year":2009,"publication_date":"2009-12-01","ids":{"openalex":"https://openalex.org/W2102632804","doi":"https://doi.org/10.1109/icdm.2009.60","mag":"2102632804"},"language":"en","primary_location":{"id":"doi:10.1109/icdm.2009.60","doi":"https://doi.org/10.1109/icdm.2009.60","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icdm.2009.60","pdf_url":null,"source":{"id":"https://openalex.org/S4210214883","display_name":"Proceedings","issn_l":"1550-4786","issn":["1550-4786","2374-8486"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","norway-1"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2009 Ninth IEEE International Conference on Data Mining","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5086820941","display_name":"Qiang Fu","orcid":"https://orcid.org/0000-0002-5821-7267","observed_orcids":["https://orcid.org/0000-0002-5821-7267"]},"institutions":[{"id":"https://openalex.org/I4210113369","display_name":"Microsoft Research Asia (China)","ror":"https://ror.org/0300m5276","country_code":"CN","type":"company","lineage":["https://openalex.org/I1290206253","https://openalex.org/I4210113369"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qiang Fu","raw_affiliation_strings":["Microsoft Research Asia, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Microsoft Research Asia, Beijing, China","institution_ids":["https://openalex.org/I4210113369"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025118710","display_name":"Jian\u2013Guang Lou","orcid":"https://orcid.org/0000-0001-8496-033X","observed_orcids":["https://orcid.org/0000-0001-8496-033X"]},"institutions":[{"id":"https://openalex.org/I4210113369","display_name":"Microsoft Research Asia (China)","ror":"https://ror.org/0300m5276","country_code":"CN","type":"company","lineage":["https://openalex.org/I1290206253","https://openalex.org/I4210113369"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jian-Guang Lou","raw_affiliation_strings":["Microsoft Research Asia, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Microsoft Research Asia, Beijing, China","institution_ids":["https://openalex.org/I4210113369"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101479349","display_name":"Yi Wang","orcid":"https://orcid.org/0009-0005-2430-2817","observed_orcids":["https://orcid.org/0009-0005-2430-2817"]},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yi Wang","raw_affiliation_strings":["Department of Computer Science & Technology, Beijing University of Posts and Telecommunications, Beijing, China","Beijing Univ. Of Posts & Telecommun., Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science & Technology, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]},{"raw_affiliation_string":"Beijing Univ. Of Posts & Telecommun., Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100392353","display_name":"Li Jiang","orcid":"https://orcid.org/0000-0001-7058-6957","observed_orcids":["https://orcid.org/0000-0001-7058-6957","https://orcid.org/0000-0003-0091-6986"]},"institutions":[{"id":"https://openalex.org/I4210113369","display_name":"Microsoft Research Asia (China)","ror":"https://ror.org/0300m5276","country_code":"CN","type":"company","lineage":["https://openalex.org/I1290206253","https://openalex.org/I4210113369"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiang Li","raw_affiliation_strings":["Microsoft Research Asia, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Microsoft Research Asia, Beijing, China","institution_ids":["https://openalex.org/I4210113369"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":6.773,"has_fulltext":false,"cited_by_count":570,"citation_normalized_percentile":{"value":0.97907301,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":99,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"149","last_page":"158"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10772","display_name":"Distributed systems and fault tolerance","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/distributed-systems","display_name":"distributed systems","score":0.8799999952316284},{"id":"https://openalex.org/keywords/finite-state-machines","display_name":"finite automata","score":0.7269999980926514},{"id":"https://openalex.org/keywords/performance-measurement-model","display_name":"performance measurement model","score":0.9070000052452087},{"id":"https://openalex.org/keywords/hadoop","display_name":"Hadoop","score":0.781000018119812},{"id":"https://openalex.org/keywords/silk","display_name":"silk","score":0.7590000033378601},{"id":"https://openalex.org/keywords/performance-issues","display_name":"performance problems","score":0.5740000009536743}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8369290828704834},{"id":"https://openalex.org/C147494362","wikidata":"https://www.wikidata.org/wiki/Q2078905","display_name":"Troubleshooting","level":2,"score":0.8026733994483948},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6847280263900757},{"id":"https://openalex.org/C104352257","wikidata":"https://www.wikidata.org/wiki/Q1238961","display_name":"Web log analysis software","level":5,"score":0.43175333738327026},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4274044334888458},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3888133764266968},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.32272565364837646},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.1796821653842926},{"id":"https://openalex.org/C173576120","wikidata":"https://www.wikidata.org/wiki/Q2641220","display_name":"Static web page","level":4,"score":0.0},{"id":"https://openalex.org/C11392498","wikidata":"https://www.wikidata.org/wiki/Q11288","display_name":"Web server","level":3,"score":0.0},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/icdm.2009.60","doi":"https://doi.org/10.1109/icdm.2009.60","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icdm.2009.60","pdf_url":null,"source":{"id":"https://openalex.org/S4210214883","display_name":"Proceedings","issn_l":"1550-4786","issn":["1550-4786","2374-8486"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","norway-1"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2009 Ninth IEEE International Conference on Data Mining","raw_type":"proceedings-article"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.170.5367","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.170.5367","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://research.microsoft.com/pubs/102365/dm790-cr.pdf","raw_type":"text"}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":20,"referenced_works":["https://openalex.org/W164902916","https://openalex.org/W1591888204","https://openalex.org/W2015979301","https://openalex.org/W2042146663","https://openalex.org/W2100830825","https://openalex.org/W2102099585","https://openalex.org/W2105454049","https://openalex.org/W2119565742","https://openalex.org/W2120376200","https://openalex.org/W2122465391","https://openalex.org/W2131109383","https://openalex.org/W2133441575","https://openalex.org/W2152878141","https://openalex.org/W2155293476","https://openalex.org/W2156618683","https://openalex.org/W2157593310","https://openalex.org/W2295399529","https://openalex.org/W3145311561","https://openalex.org/W4239670432","https://openalex.org/W4252835114"],"related_works":["https://openalex.org/W1540258466","https://openalex.org/W2804315071","https://openalex.org/W3134843924","https://openalex.org/W2901713663","https://openalex.org/W4409729599","https://openalex.org/W7214662090","https://openalex.org/W4366768971","https://openalex.org/W4416873336","https://openalex.org/W4205202105","https://openalex.org/W7126257174"],"abstract_inverted_index":{"Detection":[0],"of":[1,14,61,135],"execution":[2,137,181],"anomalies":[3,20,51,72,90,198],"is":[4,52,66,175],"very":[5],"important":[6],"for":[7,39,70,89,163],"the":[8,56,93,124,128,159,168,179,185,211],"maintenance,":[9],"development,":[10],"and":[11,26,41,59,207],"performance":[12,28,172,182],"refinement":[13],"large":[15],"scale":[16,58],"distributed":[17,37,62],"systems.":[18,63],"Execution":[19],"include":[21],"both":[22],"work":[23,161],"flow":[24,162],"errors":[25],"low":[27],"problems.":[29],"People":[30],"often":[31],"use":[32],"system":[33,47,136,165],"logs":[34,48],"produced":[35],"by":[36],"systems":[38],"troubleshooting":[40],"problem":[42],"diagnosis.":[43],"However,":[44],"manually":[45],"inspecting":[46],"to":[49,55,100,109,123,143,157,177],"detect":[50,197,215],"unfeasible":[53],"due":[54],"increasing":[57],"complexity":[60],"Therefore,":[64],"there":[65],"a":[67,97,148,171],"great":[68],"demand":[69],"automatic":[71],"detection":[73],"techniques":[74],"based":[75,183],"on":[76,115,184,205],"log":[77,86,107,110,120,141,144,155,186,202],"analysis.":[78],"In":[79,92],"this":[80],"paper,":[81],"we":[82,95,146,194],"propose":[83,96],"an":[84],"unstructured":[85],"analysis":[87],"technique":[88,212],"detection.":[91],"technique,":[94],"novel":[98],"algorithm":[99],"convert":[101],"free":[102],"form":[103],"text":[104],"messages":[105,142],"in":[106,127,199],"files":[108],"keys":[111,121],"without":[112],"heavily":[113],"relying":[114],"application":[116],"specific":[117],"knowledge.":[118],"The":[119],"correspond":[122],"log-print":[125],"statements":[126],"source":[129],"code":[130],"which":[131],"can":[132,195,213],"provide":[133],"cues":[134],"behavior.":[138],"After":[139],"converting":[140],"keys,":[145],"learn":[147],"Finite":[149],"State":[150],"Automaton":[151],"(FSA)":[152],"from":[153],"training":[154],"sequences":[156],"present":[158],"normal":[160,180],"each":[164],"component.":[166],"At":[167],"same":[169],"time,":[170],"measurement":[173],"model":[174],"learned":[176,192],"characterize":[178],"messages'":[187],"timing":[188],"information.":[189],"With":[190],"these":[191],"models,":[193],"automatically":[196],"newly":[200],"input":[201],"files.":[203],"Experiments":[204],"Hadoop":[206],"SILK":[208],"show":[209],"that":[210],"effectively":[214],"running":[216],"anomalies.":[217]},"counts_by_year":[{"year":2026,"cited_by_count":17},{"year":2025,"cited_by_count":33},{"year":2024,"cited_by_count":41},{"year":2023,"cited_by_count":63},{"year":2022,"cited_by_count":46},{"year":2021,"cited_by_count":81},{"year":2020,"cited_by_count":66},{"year":2019,"cited_by_count":51},{"year":2018,"cited_by_count":45},{"year":2017,"cited_by_count":23},{"year":2016,"cited_by_count":38},{"year":2015,"cited_by_count":15},{"year":2014,"cited_by_count":14},{"year":2013,"cited_by_count":10},{"year":2012,"cited_by_count":10}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2016-06-24T00:00:00"}