{"id":"https://openalex.org/W7128471925","doi":"https://doi.org/10.1109/icde65706.2026.00135","title":"Krone: Hierarchical and Modular Log Anomaly Detection","display_name":"Krone: Hierarchical and Modular Log Anomaly Detection","publication_year":2026,"publication_date":"2026-05-01","ids":{"openalex":"https://openalex.org/W7128471925","doi":"https://doi.org/10.1109/icde65706.2026.00135"},"language":"en","primary_location":{"id":"doi:10.1109/icde65706.2026.00135","doi":"https://doi.org/10.1109/icde65706.2026.00135","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icde65706.2026.00135","pdf_url":null,"source":{"id":"https://openalex.org/S4210210321","display_name":"IEEE International Conference on Data Engineering (ICDE)","issn_l":"1084-4627","issn":["1084-4627","2375-0286"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","norway-2"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 IEEE 42nd International Conference on Data Engineering (ICDE)","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2602.07303","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5125507754","display_name":"Lei Ma","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I107077323","display_name":"Worcester Polytechnic Institute","ror":"https://ror.org/05ejpqr48","country_code":"US","type":"education","lineage":["https://openalex.org/I107077323"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Lei Ma","raw_affiliation_strings":["Worcester Polytechnic Institute"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Worcester Polytechnic Institute","institution_ids":["https://openalex.org/I107077323"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125510426","display_name":"Jinyang Liu","orcid":"https://orcid.org/0000-0003-0037-1912","observed_orcids":["https://orcid.org/0000-0003-0037-1912"]},"institutions":[{"id":"https://openalex.org/I4405256866","display_name":"ByteDance (China)","ror":"https://ror.org/04m8av638","country_code":"CN","type":"company","lineage":["https://openalex.org/I4405256866"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jinyang Liu","raw_affiliation_strings":["ByteDance Inc"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"ByteDance Inc","institution_ids":["https://openalex.org/I4405256866"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125522747","display_name":"Tieying Zhang","orcid":"https://orcid.org/0009-0003-2250-5528","observed_orcids":["https://orcid.org/0009-0003-2250-5528"]},"institutions":[{"id":"https://openalex.org/I4405256866","display_name":"ByteDance (China)","ror":"https://ror.org/04m8av638","country_code":"CN","type":"company","lineage":["https://openalex.org/I4405256866"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tieying Zhang","raw_affiliation_strings":["ByteDance Inc"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"ByteDance Inc","institution_ids":["https://openalex.org/I4405256866"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5062753670","display_name":"Peter M. VanNostrand","orcid":"https://orcid.org/0000-0002-0285-6019","observed_orcids":["https://orcid.org/0000-0002-0285-6019"]},"institutions":[{"id":"https://openalex.org/I107077323","display_name":"Worcester Polytechnic Institute","ror":"https://ror.org/05ejpqr48","country_code":"US","type":"education","lineage":["https://openalex.org/I107077323"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Peter M. VanNostrand","raw_affiliation_strings":["Worcester Polytechnic Institute"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Worcester Polytechnic Institute","institution_ids":["https://openalex.org/I107077323"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5089949276","display_name":"Dennis M. Hofmann","orcid":"https://orcid.org/0000-0002-8102-3081","observed_orcids":["https://orcid.org/0000-0002-8102-3081"]},"institutions":[{"id":"https://openalex.org/I107077323","display_name":"Worcester Polytechnic Institute","ror":"https://ror.org/05ejpqr48","country_code":"US","type":"education","lineage":["https://openalex.org/I107077323"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dennis M. Hofmann","raw_affiliation_strings":["Worcester Polytechnic Institute"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Worcester Polytechnic Institute","institution_ids":["https://openalex.org/I107077323"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049926126","display_name":"Lei Cao","orcid":"https://orcid.org/0000-0001-9909-8607","observed_orcids":["https://orcid.org/0000-0001-9909-8607","https://orcid.org/0009-0008-8349-5534"]},"institutions":[{"id":"https://openalex.org/I138006243","display_name":"University of Arizona","ror":"https://ror.org/03m2x1q45","country_code":"US","type":"education","lineage":["https://openalex.org/I138006243"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Lei Cao","raw_affiliation_strings":["University of Arizona"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Arizona","institution_ids":["https://openalex.org/I138006243"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5008269094","display_name":"Elke Angelika Rundensteiner","orcid":"https://orcid.org/0000-0001-5375-9254","observed_orcids":["https://orcid.org/0000-0001-5375-9254"]},"institutions":[{"id":"https://openalex.org/I107077323","display_name":"Worcester Polytechnic Institute","ror":"https://ror.org/05ejpqr48","country_code":"US","type":"education","lineage":["https://openalex.org/I107077323"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Elke A. Rundensteiner","raw_affiliation_strings":["Worcester Polytechnic Institute"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Worcester Polytechnic Institute","institution_ids":["https://openalex.org/I107077323"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5125566033","display_name":"Jianjun Chen","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4405256866","display_name":"ByteDance (China)","ror":"https://ror.org/04m8av638","country_code":"CN","type":"company","lineage":["https://openalex.org/I4405256866"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jianjun Chen","raw_affiliation_strings":["ByteDance Inc"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"ByteDance Inc","institution_ids":["https://openalex.org/I4405256866"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":8.8181,"has_fulltext":true,"cited_by_count":2,"citation_normalized_percentile":{"value":0.96539702,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":96},"biblio":{"volume":null,"issue":null,"first_page":"1773","last_page":"1787"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/log-based-anomaly-detection","display_name":"log anomaly detection","score":1.0}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7174000144004822},{"id":"https://openalex.org/C101468663","wikidata":"https://www.wikidata.org/wiki/Q1620158","display_name":"Modular design","level":2,"score":0.6661999821662903},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5827000141143799},{"id":"https://openalex.org/C97256817","wikidata":"https://www.wikidata.org/wiki/Q1462316","display_name":"Spurious relationship","level":2,"score":0.5509999990463257},{"id":"https://openalex.org/C31170391","wikidata":"https://www.wikidata.org/wiki/Q188619","display_name":"Hierarchy","level":2,"score":0.4603999853134155},{"id":"https://openalex.org/C115537543","wikidata":"https://www.wikidata.org/wiki/Q165596","display_name":"Cache","level":2,"score":0.4343999922275543},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.423799991607666},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4189999997615814},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.3939000070095062},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.3693000078201294},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.36579999327659607},{"id":"https://openalex.org/C206588197","wikidata":"https://www.wikidata.org/wiki/Q846574","display_name":"Reuse","level":2,"score":0.36399999260902405},{"id":"https://openalex.org/C106131492","wikidata":"https://www.wikidata.org/wiki/Q3072260","display_name":"Filter (signal processing)","level":2,"score":0.36079999804496765},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.34310001134872437},{"id":"https://openalex.org/C124304363","wikidata":"https://www.wikidata.org/wiki/Q673661","display_name":"Abstraction","level":2,"score":0.3287000060081482},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.31940001249313354},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.31439998745918274},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.296099990606308},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.2784000039100647},{"id":"https://openalex.org/C9357733","wikidata":"https://www.wikidata.org/wiki/Q6878417","display_name":"Missing data","level":2,"score":0.273499995470047},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.2696000039577484},{"id":"https://openalex.org/C149629883","wikidata":"https://www.wikidata.org/wiki/Q660926","display_name":"Fraction (chemistry)","level":2,"score":0.26930001378059387},{"id":"https://openalex.org/C58489278","wikidata":"https://www.wikidata.org/wiki/Q1172284","display_name":"Data set","level":2,"score":0.2581999897956848},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.25360000133514404}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/icde65706.2026.00135","doi":"https://doi.org/10.1109/icde65706.2026.00135","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icde65706.2026.00135","pdf_url":null,"source":{"id":"https://openalex.org/S4210210321","display_name":"IEEE International Conference on Data Engineering (ICDE)","issn_l":"1084-4627","issn":["1084-4627","2375-0286"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","norway-2"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 IEEE 42nd International Conference on Data Engineering (ICDE)","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2602.07303","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2602.07303","pdf_url":"https://arxiv.org/pdf/2602.07303","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"public-domain","license_id":"https://openalex.org/licenses/public-domain","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2602.07303","doi":"https://doi.org/10.48550/arxiv.2602.07303","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2602.07303","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2602.07303","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2602.07303","pdf_url":"https://arxiv.org/pdf/2602.07303","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"public-domain","license_id":"https://openalex.org/licenses/public-domain","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7128471925.pdf","grobid_xml":"https://content.openalex.org/works/W7128471925.grobid-xml"},"referenced_works_count":67,"referenced_works":["https://openalex.org/W1608194207","https://openalex.org/W1661413208","https://openalex.org/W2039157918","https://openalex.org/W2102632804","https://openalex.org/W2107263349","https://openalex.org/W2110893883","https://openalex.org/W2115056012","https://openalex.org/W2132870739","https://openalex.org/W2147694185","https://openalex.org/W2296719434","https://openalex.org/W2560021099","https://openalex.org/W2583874385","https://openalex.org/W2754665629","https://openalex.org/W2755791218","https://openalex.org/W2767094836","https://openalex.org/W2947815220","https://openalex.org/W2963999143","https://openalex.org/W2965838158","https://openalex.org/W2981613521","https://openalex.org/W3011594683","https://openalex.org/W3025151218","https://openalex.org/W3032553678","https://openalex.org/W3095840026","https://openalex.org/W3127712067","https://openalex.org/W3169066865","https://openalex.org/W3199174176","https://openalex.org/W3209873929","https://openalex.org/W4205965165","https://openalex.org/W4221161695","https://openalex.org/W4226128225","https://openalex.org/W4283830961","https://openalex.org/W4284688717","https://openalex.org/W4290927906","https://openalex.org/W4304195432","https://openalex.org/W4308512861","https://openalex.org/W4311091257","https://openalex.org/W4327503230","https://openalex.org/W4376288669","https://openalex.org/W4378498632","https://openalex.org/W4380433171","https://openalex.org/W4385567149","https://openalex.org/W4385621806","https://openalex.org/W4388585808","https://openalex.org/W4389713789","https://openalex.org/W4391096001","https://openalex.org/W4391876619","https://openalex.org/W4394745212","https://openalex.org/W4395686609","https://openalex.org/W4399115803","https://openalex.org/W4399511779","https://openalex.org/W4399631359","https://openalex.org/W4401023643","https://openalex.org/W4402951147","https://openalex.org/W4402969640","https://openalex.org/W4403422692","https://openalex.org/W4405755985","https://openalex.org/W4406302454","https://openalex.org/W4407123924","https://openalex.org/W4407208970","https://openalex.org/W4411120260","https://openalex.org/W4411538180","https://openalex.org/W4411552468","https://openalex.org/W4413360766","https://openalex.org/W4414128359","https://openalex.org/W6903651657","https://openalex.org/W6948187282","https://openalex.org/W7133224126"],"related_works":["https://openalex.org/W7160887004","https://openalex.org/W4311091257","https://openalex.org/W4404407704","https://openalex.org/W7163543695","https://openalex.org/W7205016842","https://openalex.org/W7160067388","https://openalex.org/W4379116344","https://openalex.org/W7212224259","https://openalex.org/W4386882212","https://openalex.org/W7160707703"],"abstract_inverted_index":{"Log":[0,77],"anomaly":[1,55,70,149],"detection":[2,56,104,112,124,150,156],"is":[3,24],"crucial":[4],"for":[5,134],"uncovering":[6],"system":[7],"failures":[8],"and":[9,137,151,161,172,200],"security":[10],"risks.":[11],"Although":[12],"logs":[13,65],"originate":[14],"from":[15,63,176],"nested":[16],"component":[17],"executions":[18,41],"with":[19,147],"clear":[20],"boundaries,":[21],"this":[22],"structure":[23],"lost":[25],"when":[26],"stored":[27],"as":[28,98],"flat":[29,64],"sequences.":[30],"As":[31],"a":[32,106,121,138],"result,":[33],"state-of-the-art":[34],"methods":[35,212],"often":[36],"miss":[37],"true":[38],"dependencies":[39],"within":[40],"while":[42,213],"learning":[43],"spurious":[44],"correlations":[45],"across":[46],"unrelated":[47],"events.":[48],"We":[49],"propose":[50],"KRONE,":[51],"the":[52,75,165,223],"first":[53],"hierarchical":[54],"framework":[57],"that":[58,126,141,180],"automatically":[59],"derives":[60],"execution":[61,94],"hierarchies":[62],"to":[66,87,97,188,208,217,220],"enable":[67],"modular,":[68],"multi-level":[69],"detection.":[71],"At":[72],"its":[73],"core,":[74],"KRONE":[76,99,110,117,119,153,181,202],"Abstraction":[78],"Model":[79],"extracts":[80],"application-specific":[81],"semantic":[82,144],"hierarchies,":[83],"which":[84],"are":[85],"used":[86],"recursively":[88],"decompose":[89],"log":[90],"sequences":[91],"into":[92,105],"coherent":[93],"units,":[95],"referred":[96],"Seqs.":[100],"This":[101],"transforms":[102],"sequence-level":[103],"set":[107],"of":[108,222],"modular":[109,123],"Seq-level":[111],"tasks.":[113],"For":[114],"each":[115],"test":[116,224],"Seq,":[118],"adopts":[120],"hybrid":[122],"strategy":[125],"routes":[127],"between":[128],"an":[129],"efficient":[130],"level-independent":[131],"Local-Context":[132],"detector":[133,140],"rapid":[135],"filtering":[136],"Nested-Aware":[139],"captures":[142],"cross-level":[143],"dependencies,":[145],"augmented":[146],"LLM-based":[148],"explanation.":[152],"further":[154],"optimizes":[155],"through":[157],"cached":[158],"result":[159],"reuse":[160],"early-exit":[162],"strategies":[163],"along":[164],"hierarchy.":[166],"Experiments":[167],"on":[168],"three":[169],"public":[170],"benchmarks":[171],"one":[173],"industrial":[174],"dataset":[175],"ByteDance":[177],"Cloud":[178],"demonstrate":[179],"achieves":[182],"substantial":[183],"improvements":[184],"in":[185],"accuracy":[186],"(42.49%":[187],"87.98%),":[189],"F1":[190],"score,":[191],"data":[192],"efficiency":[193,197],"(117.3x":[194],"reduction),":[195,199],"resource":[196],"(43.7x":[198],"interpretability.":[201],"improves":[203],"F1-score":[204],"by":[205],"10.07%":[206],"(82.76%":[207],"92.83%)":[209],"over":[210],"prior":[211],"reducing":[214],"LLM":[215],"usage":[216],"only":[218],"1.1%":[219],"3.3%":[221],"data.":[225],"Code:":[226],"https://github.com/LeiMa0324/KRONE":[227],"Demo:":[228],"https://leima0324.github.io/KRONE_Demo_official/":[229]},"counts_by_year":[{"year":2026,"cited_by_count":2}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-02-11T00:00:00"}