{"id":"https://openalex.org/W6989671925","doi":null,"title":"Can Language Models Help in System Security? Investigating Log Anomaly Detection using BERT","display_name":"Can Language Models Help in System Security? Investigating Log Anomaly Detection using BERT","publication_year":2024,"publication_date":"2024-02-09","ids":{"openalex":"https://openalex.org/W6989671925"},"language":"en","primary_location":{"id":"pmh:oai:figshare.com:article/25194188","doi":null,"is_oa":true,"landing_page_url":"https://figshare.com/articles/conference_contribution/Can_Language_Models_Help_in_System_Security_Investigating_Log_Anomaly_Detection_using_BERT/25194188","pdf_url":null,"source":{"id":"https://openalex.org/S4377196282","display_name":"Figshare","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I4210132348","host_organization_name":"Figshare (United Kingdom)","host_organization_lineage":["https://openalex.org/I4210132348"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Conference contribution"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://figshare.com/articles/conference_contribution/Can_Language_Models_Help_in_System_Security_Investigating_Log_Anomaly_Detection_using_BERT/25194188","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5060465375","display_name":"Crispin Almodovar","orcid":"https://orcid.org/0000-0002-6435-7119","observed_orcids":["https://orcid.org/0000-0002-6435-7119"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Crispin Almodovar (17936936)","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5087242242","display_name":"Fariza Sabrina","orcid":"https://orcid.org/0000-0002-8455-2499","observed_orcids":["https://orcid.org/0000-0002-8455-2499","https://orcid.org/0009-0003-0703-1061"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Fariza Sabrina (9832118)","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5041251183","display_name":"Sarvnaz Karimi","orcid":"https://orcid.org/0000-0002-4927-3937","observed_orcids":["https://orcid.org/0000-0002-4927-3937"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sarvnaz Karimi (8587374)","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5065482364","display_name":"Salahuddin Azad","orcid":"https://orcid.org/0000-0002-6377-7912","observed_orcids":["https://orcid.org/0000-0002-6377-7912"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Salahuddin Azad (9778391)","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.8928,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":{"value":0.87878246,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":true,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9814000129699707,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9814000129699707,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.015399999916553497,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.0005000000237487257,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/log-based-anomaly-detection","display_name":"log anomaly detection","score":0.9929999709129333},{"id":"https://openalex.org/keywords/system-security","display_name":"system security","score":0.8230000138282776},{"id":"https://openalex.org/keywords/bert","display_name":"BERT","score":0.890999972820282},{"id":"https://openalex.org/keywords/self-supervised-learning","display_name":"self-supervised learning","score":0.8270000219345093},{"id":"https://openalex.org/keywords/masked-token-prediction","display_name":"masked token prediction","score":0.9580000042915344},{"id":"https://openalex.org/keywords/discriminator","display_name":"discriminator","score":0.3569999933242798},{"id":"https://openalex.org/keywords/system-logs","display_name":"system logs","score":0.5740000009536743},{"id":"https://openalex.org/keywords/unsupervised-anomaly-detection","display_name":"unsupervised anomaly detection","score":0.675000011920929}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7401999831199646},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.7361999750137329},{"id":"https://openalex.org/C2779803651","wikidata":"https://www.wikidata.org/wiki/Q5282088","display_name":"Discriminator","level":3,"score":0.6601999998092651},{"id":"https://openalex.org/C146599234","wikidata":"https://www.wikidata.org/wiki/Q511093","display_name":"Centroid","level":2,"score":0.607699990272522},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5774999856948853},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5565000176429749},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.5332000255584717},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4514000117778778},{"id":"https://openalex.org/C195324797","wikidata":"https://www.wikidata.org/wiki/Q33742","display_name":"Natural language","level":2,"score":0.3937000036239624},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3831000030040741},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.3806999921798706},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.3741999864578247},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.3555000126361847},{"id":"https://openalex.org/C2779439875","wikidata":"https://www.wikidata.org/wiki/Q1078276","display_name":"Natural language understanding","level":3,"score":0.33320000767707825},{"id":"https://openalex.org/C117884012","wikidata":"https://www.wikidata.org/wiki/Q94489","display_name":"n-gram","level":3,"score":0.32280001044273376},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3158999979496002},{"id":"https://openalex.org/C118505674","wikidata":"https://www.wikidata.org/wiki/Q42586063","display_name":"Encoder","level":2,"score":0.26600000262260437},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.265500009059906}],"mesh":[],"locations_count":1,"locations":[{"id":"pmh:oai:figshare.com:article/25194188","doi":null,"is_oa":true,"landing_page_url":"https://figshare.com/articles/conference_contribution/Can_Language_Models_Help_in_System_Security_Investigating_Log_Anomaly_Detection_using_BERT/25194188","pdf_url":null,"source":{"id":"https://openalex.org/S4377196282","display_name":"Figshare","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I4210132348","host_organization_name":"Figshare (United Kingdom)","host_organization_lineage":["https://openalex.org/I4210132348"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Conference contribution"}],"best_oa_location":{"id":"pmh:oai:figshare.com:article/25194188","doi":null,"is_oa":true,"landing_page_url":"https://figshare.com/articles/conference_contribution/Can_Language_Models_Help_in_System_Security_Investigating_Log_Anomaly_Detection_using_BERT/25194188","pdf_url":null,"source":{"id":"https://openalex.org/S4377196282","display_name":"Figshare","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I4210132348","host_organization_name":"Figshare (United Kingdom)","host_organization_lineage":["https://openalex.org/I4210132348"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Conference contribution"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W4391235307","https://openalex.org/W4226289522","https://openalex.org/W3199174176","https://openalex.org/W4309623083","https://openalex.org/W4402270600","https://openalex.org/W4378228646","https://openalex.org/W4281560964","https://openalex.org/W4386141483","https://openalex.org/W7128801333","https://openalex.org/W3198845989"],"abstract_inverted_index":{"The":[0,36,93],"log":[1,48,55,69,104,131],"files":[2],"generated":[3],"by":[4],"networked":[5],"computer":[6],"systems":[7],"contain":[8],"valuable":[9],"information":[10],"that":[11,166],"can":[12],"be":[13,63],"used":[14],"to":[15,62,122,150],"monitor":[16],"system":[17,34,91],"security":[18],"and":[19,82,111,146],"stability.":[20],"Transformer-based":[21],"natural":[22],"language":[23,80],"processing":[24],"methods":[25],"have":[26,40],"proven":[27],"effective":[28],"in":[29,54,98],"detecting":[30],"anomalous":[31],"activities":[32],"from":[33],"logs.":[35,92],"current":[37],"approaches,":[38],"however,":[39],"limited":[41],"practical":[42],"application":[43],"because":[44],"they":[45,58],"rely":[46],"on":[47,161],"templates":[49],"which":[50],"cannot":[51],"handle":[52],"variability":[53],"content,":[56],"or":[57,157],"require":[59],"supervised":[60],"training":[61,116],"effective.":[64,169],"We":[65],"propose":[66],"a":[67,77,99,135],"novel":[68],"anomaly":[70],"detection":[71],"approach":[72],"named":[73],"LogFiT.":[74],"It":[75],"utilises":[76],"pretrained":[78],"BERT-based":[79],"model":[81,95,120],"fine-tunes":[83],"it":[84],"towards":[85],"learning":[86],"the":[87,118,124,129,139,153],"linguistic":[88,125],"structure":[89],"of":[90],"LogFiT":[94,119,140,167],"is":[96,155,168],"trained":[97],"self-supervised":[100],"manner":[101],"using":[102],"normal":[103,130,156],"data":[105],"only.":[106],"Using":[107],"masked":[108],"token":[109,143],"prediction":[110,144],"centroid":[112,148],"distance":[113,149],"minimisation":[114],"as":[115],"objectives,":[117],"learns":[121],"recognise":[123],"patterns":[126],"associated":[127],"with":[128],"data.":[132],"During":[133],"inference,":[134],"discriminator":[136],"function":[137],"uses":[138],"model\u2019s":[141],"top-k":[142],"accuracy":[145],"computed":[147],"determine":[151],"if":[152],"input":[154],"anomaly.":[158],"Our":[159],"experiments":[160],"three":[162],"different":[163],"datasets":[164],"show":[165]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":5}],"updated_date":"2026-10-29T09:56:32.521200","created_date":"2025-10-10T00:00:00"}