{"id":"https://openalex.org/W4401667316","doi":"https://doi.org/10.1007/s10664-024-10533-w","title":"Impact of log parsing on deep learning-based anomaly detection","display_name":"Impact of log parsing on deep learning-based anomaly detection","publication_year":2024,"publication_date":"2024-08-17","ids":{"openalex":"https://openalex.org/W4401667316","doi":"https://doi.org/10.1007/s10664-024-10533-w","pmid":"https://pubmed.ncbi.nlm.nih.gov/39161930"},"language":"en","primary_location":{"id":"doi:10.1007/s10664-024-10533-w","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10664-024-10533-w","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10664-024-10533-w.pdf","source":{"id":"https://openalex.org/S109852484","display_name":"Empirical Software Engineering","issn_l":"1382-3256","issn":["1382-3256","1573-7616"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Empirical Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","pubmed"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s10664-024-10533-w.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5021698432","display_name":"Zanis Ali Khan","orcid":"https://orcid.org/0000-0002-3935-2148"},"institutions":[{"id":"https://openalex.org/I186903577","display_name":"University of Luxembourg","ror":"https://ror.org/036x5ad56","country_code":"LU","type":"education","lineage":["https://openalex.org/I186903577"]}],"countries":["LU"],"is_corresponding":false,"raw_author_name":"Zanis Ali Khan","raw_affiliation_strings":["University of Luxembourg, Esch-sur-Alzette, Luxembourg"],"raw_orcid":"https://orcid.org/0000-0002-3935-2148","affiliations":[{"raw_affiliation_string":"University of Luxembourg, Esch-sur-Alzette, Luxembourg","institution_ids":["https://openalex.org/I186903577"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5019085537","display_name":"Donghwan Shin","orcid":"https://orcid.org/0000-0002-0840-6449"},"institutions":[{"id":"https://openalex.org/I91136226","display_name":"University of Sheffield","ror":"https://ror.org/05krs5044","country_code":"GB","type":"education","lineage":["https://openalex.org/I91136226"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Donghwan Shin","raw_affiliation_strings":["University of Sheffield, Sheffield, United Kingdom"],"raw_orcid":"https://orcid.org/0000-0002-0840-6449","affiliations":[{"raw_affiliation_string":"University of Sheffield, Sheffield, United Kingdom","institution_ids":["https://openalex.org/I91136226"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5038017715","display_name":"Domenico Bianculli","orcid":"https://orcid.org/0000-0002-4854-685X"},"institutions":[{"id":"https://openalex.org/I186903577","display_name":"University of Luxembourg","ror":"https://ror.org/036x5ad56","country_code":"LU","type":"education","lineage":["https://openalex.org/I186903577"]}],"countries":["LU"],"is_corresponding":false,"raw_author_name":"Domenico Bianculli","raw_affiliation_strings":["University of Luxembourg, Esch-sur-Alzette, Luxembourg"],"raw_orcid":"https://orcid.org/0000-0002-4854-685X","affiliations":[{"raw_affiliation_string":"University of Luxembourg, Esch-sur-Alzette, Luxembourg","institution_ids":["https://openalex.org/I186903577"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5078533117","display_name":"Lionel Briand","orcid":"https://orcid.org/0000-0002-1393-1010"},"institutions":[{"id":"https://openalex.org/I153718931","display_name":"University of Ottawa","ror":"https://ror.org/03c4mmv16","country_code":"CA","type":"education","lineage":["https://openalex.org/I153718931"]},{"id":"https://openalex.org/I168346926","display_name":"Science Foundation Ireland","ror":"https://ror.org/0271asj38","country_code":"IE","type":"nonprofit","lineage":["https://openalex.org/I168346926"]},{"id":"https://openalex.org/I230495080","display_name":"University of Limerick","ror":"https://ror.org/00a0n9e72","country_code":"IE","type":"education","lineage":["https://openalex.org/I230495080"]},{"id":"https://openalex.org/I4210130076","display_name":"Lero","ror":"https://ror.org/038dhnb42","country_code":"IE","type":"other","lineage":["https://openalex.org/I4210130076"]}],"countries":["CA","IE"],"is_corresponding":false,"raw_author_name":"Lionel C. Briand","raw_affiliation_strings":["The Lero SFI Centre for Software Research, Limerick, Ireland","University of Limerick, Limerick, Ireland","University of Ottawa, Ottawa, Canada"],"raw_orcid":"https://orcid.org/0000-0002-1393-1010","affiliations":[{"raw_affiliation_string":"The Lero SFI Centre for Software Research, Limerick, Ireland","institution_ids":["https://openalex.org/I4210130076","https://openalex.org/I168346926"]},{"raw_affiliation_string":"University of Limerick, Limerick, Ireland","institution_ids":["https://openalex.org/I230495080"]},{"raw_affiliation_string":"University of Ottawa, Ottawa, Canada","institution_ids":["https://openalex.org/I153718931"]}]}],"institutions":[],"countries_distinct_count":4,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":2290,"currency":"EUR","value_usd":2890},"apc_paid":{"value":2290,"currency":"EUR","value_usd":2890},"fwci":9.6654,"has_fulltext":true,"cited_by_count":31,"citation_normalized_percentile":{"value":0.98475858,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":100},"biblio":{"volume":"29","issue":"6","first_page":"139","last_page":"139"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9786999821662903,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9549999833106995,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6539897918701172},{"id":"https://openalex.org/keywords/parsing","display_name":"Parsing","score":0.6019962430000305},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.5628657937049866},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5569707751274109},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5452277660369873},{"id":"https://openalex.org/keywords/natural-language-processing","display_name":"Natural language processing","score":0.4247962236404419},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.4187786281108856},{"id":"https://openalex.org/keywords/physics","display_name":"Physics","score":0.10154944658279419}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6539897918701172},{"id":"https://openalex.org/C186644900","wikidata":"https://www.wikidata.org/wiki/Q194152","display_name":"Parsing","level":2,"score":0.6019962430000305},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.5628657937049866},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5569707751274109},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5452277660369873},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.4247962236404419},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.4187786281108856},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.10154944658279419},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0}],"mesh":[],"locations_count":6,"locations":[{"id":"doi:10.1007/s10664-024-10533-w","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10664-024-10533-w","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10664-024-10533-w.pdf","source":{"id":"https://openalex.org/S109852484","display_name":"Empirical Software Engineering","issn_l":"1382-3256","issn":["1382-3256","1573-7616"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Empirical Software Engineering","raw_type":"journal-article"},{"id":"pmid:39161930","is_oa":false,"landing_page_url":"https://pubmed.ncbi.nlm.nih.gov/39161930","pdf_url":null,"source":{"id":"https://openalex.org/S4306525036","display_name":"PubMed","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Empirical software engineering","raw_type":null},{"id":"pmh:oai:eprints.whiterose.ac.uk:216228","is_oa":true,"landing_page_url":"https://orcid.org/0000-0002-3935-2148>,","pdf_url":"https://eprints.whiterose.ac.uk/216228/1/s10664-024-10533-w.pdf","source":{"id":"https://openalex.org/S4306400854","display_name":"White Rose Research Online (University of Leeds, The University of Sheffield, University of York)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I2800616092","host_organization_name":"White Rose University Consortium","host_organization_lineage":["https://openalex.org/I2800616092"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"PeerReviewed"},{"id":"pmh:oai:orbilu.uni.lu:10993/57620","is_oa":true,"landing_page_url":"https://orbilu.uni.lu/handle/10993/57620","pdf_url":"https://orbilu.uni.lu/bitstream/10993/57620/1/zanis_anomaly_detection_log_parsing.pdf","source":{"id":"https://openalex.org/S4306401815","display_name":"Open Repository and Bibliography (University of Luxembourg)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I186903577","host_organization_name":"University of Luxembourg","host_organization_lineage":["https://openalex.org/I186903577"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Empirical Software Engineering, 29, 139:1--139:33 (2024)","raw_type":"peer reviewed"},{"id":"pmh:oai:orbilu.uni.lu:10993/61817","is_oa":true,"landing_page_url":"https://orbilu.uni.lu/handle/10993/61817","pdf_url":"https://orbilu.uni.lu/bitstream/10993/61817/1/zanis_anomaly_detection_log_parsing.pdf","source":{"id":"https://openalex.org/S4306401815","display_name":"Open Repository and Bibliography (University of Luxembourg)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I186903577","host_organization_name":"University of Luxembourg","host_organization_lineage":["https://openalex.org/I186903577"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Empirical Software Engineering, 29, 139:1--139:33 (2024)","raw_type":"journal article"},{"id":"pmh:oai:pubmedcentral.nih.gov:11330418","is_oa":true,"landing_page_url":"https://www.ncbi.nlm.nih.gov/pmc/articles/11330418","pdf_url":"https://pmc.ncbi.nlm.nih.gov/articles/PMC11330418/pdf/10664_2024_Article_10533.pdf","source":{"id":"https://openalex.org/S2764455111","display_name":"PubMed Central","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Empir Softw Eng","raw_type":"Text"}],"best_oa_location":{"id":"doi:10.1007/s10664-024-10533-w","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10664-024-10533-w","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10664-024-10533-w.pdf","source":{"id":"https://openalex.org/S109852484","display_name":"Empirical Software Engineering","issn_l":"1382-3256","issn":["1382-3256","1573-7616"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Empirical Software Engineering","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1482659561","display_name":null,"funder_award_id":"13/RC/2094-2","funder_id":"https://openalex.org/F4320320847","funder_display_name":"Science Foundation Ireland"},{"id":"https://openalex.org/G2588960202","display_name":null,"funder_award_id":"CC BY 4.0","funder_id":"https://openalex.org/F4320321038","funder_display_name":"Fonds National de la Recherche Luxembourg"},{"id":"https://openalex.org/G7370405752","display_name":null,"funder_award_id":"C22/IS/17373407/LOGODOR","funder_id":"https://openalex.org/F4320321038","funder_display_name":"Fonds National de la Recherche Luxembourg"},{"id":"https://openalex.org/G7736775806","display_name":null,"funder_award_id":"13/RC/2094","funder_id":"https://openalex.org/F4320320847","funder_display_name":"Science Foundation Ireland"}],"funders":[{"id":"https://openalex.org/F4320320847","display_name":"Science Foundation Ireland","ror":"https://ror.org/0271asj38"},{"id":"https://openalex.org/F4320321038","display_name":"Fonds National de la Recherche Luxembourg","ror":"https://ror.org/039z13y21"},{"id":"https://openalex.org/F4320334593","display_name":"Natural Sciences and Engineering Research Council of Canada","ror":"https://ror.org/01h531d29"}],"has_content":{"pdf":true,"grobid_xml":false},"content_urls":{"pdf":"https://content.openalex.org/works/W4401667316.pdf"},"referenced_works_count":42,"referenced_works":["https://openalex.org/W1661413208","https://openalex.org/W1857789879","https://openalex.org/W1978394996","https://openalex.org/W1994625872","https://openalex.org/W2008056655","https://openalex.org/W2015979301","https://openalex.org/W2076809217","https://openalex.org/W2102632804","https://openalex.org/W2115056012","https://openalex.org/W2153470728","https://openalex.org/W2208211896","https://openalex.org/W2536393303","https://openalex.org/W2754665629","https://openalex.org/W2767094836","https://openalex.org/W2792207129","https://openalex.org/W2911964244","https://openalex.org/W2947815220","https://openalex.org/W2963999143","https://openalex.org/W2964199361","https://openalex.org/W2998526767","https://openalex.org/W3041215671","https://openalex.org/W3095516699","https://openalex.org/W3127712067","https://openalex.org/W3150554727","https://openalex.org/W3183619936","https://openalex.org/W3203565869","https://openalex.org/W4205965165","https://openalex.org/W4244233294","https://openalex.org/W4255845613","https://openalex.org/W4284692184","https://openalex.org/W4308512861","https://openalex.org/W4380433171","https://openalex.org/W4384345672","https://openalex.org/W4384347367","https://openalex.org/W4385485508","https://openalex.org/W4387430347","https://openalex.org/W4387435361","https://openalex.org/W4401667316","https://openalex.org/W6600459194","https://openalex.org/W6630595383","https://openalex.org/W6702248584","https://openalex.org/W6902173151"],"related_works":["https://openalex.org/W2806741695","https://openalex.org/W4290647774","https://openalex.org/W3189286258","https://openalex.org/W3207797160","https://openalex.org/W3210364259","https://openalex.org/W4300558037","https://openalex.org/W2912112202","https://openalex.org/W6643695","https://openalex.org/W2667207928","https://openalex.org/W4381248170"],"abstract_inverted_index":{"Software":[0],"systems":[1],"log":[2,56,63,85,112,120,143,161,175,198],"massive":[3],"amounts":[4],"of":[5,28,62,68,111,169],"data,":[6],"recording":[7],"important":[8],"runtime":[9],"information.":[10],"Such":[11],"logs":[12],"are":[13,81],"used,":[14],"for":[15,17,173],"example,":[16],"log-based":[18,42],"anomaly":[19,43,69,93,115,165,212],"detection,":[20],"which":[21],"aims":[22],"to":[23,91,194,202],"automatically":[24],"detect":[25],"abnormal":[26],"behaviors":[27],"the":[29,35,60,66,82,109,170],"system":[30],"under":[31],"analysis":[32],"by":[33],"processing":[34],"information":[36],"recorded":[37],"in":[38,197,209],"its":[39],"logs.":[40],"Many":[41],"detection":[44,70,94,116,125,166],"techniques":[45,71,87,126],"based":[46,128,134],"on":[47,65,103,108,114,129,135,139],"deep":[48,130],"learning":[49,131],"models":[50],"include":[51],"a":[52,104,189],"pre-processing":[53],"step":[54],"called":[55],"parsing.":[57],"However,":[58],"understanding":[59],"impact":[61,110],"parsing":[64,86,113,121,162,176,199],"accuracy":[67,163],"has":[72],"received":[73],"surprisingly":[74],"little":[75],"attention":[76],"so":[77],"far.":[78],"Investigating":[79],"what":[80,151],"key":[83],"properties":[84],"should":[88],"ideally":[89],"have":[90],"help":[92],"is":[95,152,156,188],"therefore":[96],"warranted.":[97],"In":[98],"this":[99],"paper,":[100],"we":[101,179,192],"report":[102],"comprehensive":[105],"empirical":[106,146],"study":[107],"accuracy,":[117,167],"using":[118],"13":[119],"techniques,":[122],"seven":[123],"anomly":[124],"(five":[127],"and":[132,164],"two":[133],"traditional":[136],"machine":[137],"learning)":[138],"three":[140],"publicly":[141],"available":[142],"datasets.":[144],"Our":[145],"results":[147,184],"show":[148],"that,":[149],"despite":[150],"widely":[153],"assumed,":[154],"there":[155],"no":[157],"strong":[158],"correlation":[159],"between":[160],"regardless":[168],"metric":[171],"used":[172],"measuring":[174],"accuracy.":[177],"Moreover,":[178],"experimentally":[180],"confirm":[181],"existing":[182],"theoretical":[183],"showing":[185],"that":[186,191],"it":[187],"property":[190],"refer":[193],"as":[195],"distinguishability":[196],"results-as":[200],"opposed":[201],"their":[203],"accuracy-that":[204],"plays":[205],"an":[206],"essential":[207],"role":[208],"achieving":[210],"accurate":[211],"detection.":[213]},"counts_by_year":[{"year":2026,"cited_by_count":8},{"year":2025,"cited_by_count":22},{"year":2024,"cited_by_count":1}],"updated_date":"2026-06-12T08:23:45.883708","created_date":"2025-10-10T00:00:00"}