{"id":"https://openalex.org/W4383174304","doi":"https://doi.org/10.1007/s10618-026-01235-6","title":"Graph neural networks based log anomaly detection and explanation","display_name":"Graph neural networks based log anomaly detection and explanation","publication_year":2026,"publication_date":"2026-07-03","ids":{"openalex":"https://openalex.org/W4383174304","doi":"https://doi.org/10.1007/s10618-026-01235-6","pmid":"https://pubmed.ncbi.nlm.nih.gov/42403933"},"language":"en","primary_location":{"id":"doi:10.1007/s10618-026-01235-6","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10618-026-01235-6","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10618-026-01235-6.pdf","source":{"id":"https://openalex.org/S121920818","display_name":"Data Mining and Knowledge Discovery","issn_l":"1384-5810","issn":["1384-5810","1573-756X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Data Mining and Knowledge Discovery","raw_type":"journal-article"},"type":"article","indexed_in":["arxiv","crossref","datacite","pubmed"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s10618-026-01235-6.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100428658","display_name":"Zhong Li","orcid":"https://orcid.org/0000-0003-1124-5778"},"institutions":[{"id":"https://openalex.org/I121797337","display_name":"Leiden University","ror":"https://ror.org/027bh9e22","country_code":"NL","type":"education","lineage":["https://openalex.org/I121797337"]},{"id":"https://openalex.org/I2799850029","display_name":"Dongguan University of Technology","ror":"https://ror.org/01m8p7q42","country_code":"CN","type":"education","lineage":["https://openalex.org/I2799850029"]}],"countries":["CN","NL"],"is_corresponding":true,"raw_author_name":"Zhong Li","raw_affiliation_strings":["Leiden Institute of Advanced Computer Science (LIACS), Leiden University, Leiden, The Netherlands","The Intelligent Computing Research Center, Great Bay University, Dongguan, China"],"raw_orcid":"https://orcid.org/0000-0003-1124-5778","affiliations":[{"raw_affiliation_string":"Leiden Institute of Advanced Computer Science (LIACS), Leiden University, Leiden, The Netherlands","institution_ids":["https://openalex.org/I121797337"]},{"raw_affiliation_string":"The Intelligent Computing Research Center, Great Bay University, Dongguan, China","institution_ids":["https://openalex.org/I2799850029"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5071898836","display_name":"Jiayang Shi","orcid":"https://orcid.org/0000-0002-7014-0805"},"institutions":[{"id":"https://openalex.org/I121797337","display_name":"Leiden University","ror":"https://ror.org/027bh9e22","country_code":"NL","type":"education","lineage":["https://openalex.org/I121797337"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Jiayang Shi","raw_affiliation_strings":["Leiden Institute of Advanced Computer Science (LIACS), Leiden University, Leiden, The Netherlands"],"raw_orcid":"https://orcid.org/0000-0002-7014-0805","affiliations":[{"raw_affiliation_string":"Leiden Institute of Advanced Computer Science (LIACS), Leiden University, Leiden, The Netherlands","institution_ids":["https://openalex.org/I121797337"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5022646570","display_name":"Matthijs van Leeuwen","orcid":"https://orcid.org/0000-0002-0510-3549"},"institutions":[{"id":"https://openalex.org/I121797337","display_name":"Leiden University","ror":"https://ror.org/027bh9e22","country_code":"NL","type":"education","lineage":["https://openalex.org/I121797337"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Matthijs van Leeuwen","raw_affiliation_strings":["Leiden Institute of Advanced Computer Science (LIACS), Leiden University, Leiden, The Netherlands"],"raw_orcid":"https://orcid.org/0000-0002-0510-3549","affiliations":[{"raw_affiliation_string":"Leiden Institute of Advanced Computer Science (LIACS), Leiden University, Leiden, The Netherlands","institution_ids":["https://openalex.org/I121797337"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5100428658"],"corresponding_institution_ids":["https://openalex.org/I121797337","https://openalex.org/I2799850029"],"apc_list":{"value":2990,"currency":"USD","value_usd":2990},"apc_paid":{"value":2990,"currency":"USD","value_usd":2990},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.00100408,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"40","issue":"5","first_page":"66","last_page":"66"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9921000003814697,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9718999862670898,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.8163633346557617},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6585232019424438},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.5661028623580933},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.49752333760261536},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.4830551743507385},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4811635911464691},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.470967561006546},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.4554864466190338},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.4194273352622986},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.20969119668006897}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.8163633346557617},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6585232019424438},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.5661028623580933},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.49752333760261536},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.4830551743507385},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4811635911464691},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.470967561006546},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.4554864466190338},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4194273352622986},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.20969119668006897},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C205649164","wikidata":"https://www.wikidata.org/wiki/Q1071","display_name":"Geography","level":0,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C13280743","wikidata":"https://www.wikidata.org/wiki/Q131089","display_name":"Geodesy","level":1,"score":0.0}],"mesh":[],"locations_count":5,"locations":[{"id":"doi:10.1007/s10618-026-01235-6","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10618-026-01235-6","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10618-026-01235-6.pdf","source":{"id":"https://openalex.org/S121920818","display_name":"Data Mining and Knowledge Discovery","issn_l":"1384-5810","issn":["1384-5810","1573-756X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Data Mining and Knowledge Discovery","raw_type":"journal-article"},{"id":"pmid:42403933","is_oa":false,"landing_page_url":"https://pubmed.ncbi.nlm.nih.gov/42403933","pdf_url":null,"source":{"id":"https://openalex.org/S4306525036","display_name":"PubMed","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Data mining and knowledge discovery","raw_type":null},{"id":"pmh:oai:arXiv.org:2307.00527","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2307.00527","pdf_url":"https://arxiv.org/pdf/2307.00527","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-sa","license_id":"https://openalex.org/licenses/cc-by-nc-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"text"},{"id":"pmh:oai:pubmedcentral.nih.gov:13331892","is_oa":true,"landing_page_url":"https://pmc.ncbi.nlm.nih.gov/articles/PMC13331892/","pdf_url":null,"source":{"id":"https://openalex.org/S2764455111","display_name":"PubMed Central","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Data Min Knowl Discov","raw_type":"Text"},{"id":"doi:10.48550/arxiv.2307.00527","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2307.00527","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.1007/s10618-026-01235-6","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10618-026-01235-6","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10618-026-01235-6.pdf","source":{"id":"https://openalex.org/S121920818","display_name":"Data Mining and Knowledge Discovery","issn_l":"1384-5810","issn":["1384-5810","1573-756X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Data Mining and Knowledge Discovery","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1502848176","display_name":null,"funder_award_id":"P18-03","funder_id":"https://openalex.org/F4320321800","funder_display_name":"Nederlandse Organisatie voor Wetenschappelijk Onderzoek"},{"id":"https://openalex.org/G2001806450","display_name":null,"funder_award_id":"H2020-MSCA-ITN","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"},{"id":"https://openalex.org/G3345895242","display_name":null,"funder_award_id":"H2020-MSCA","funder_id":"https://openalex.org/F4320332999","funder_display_name":"Horizon 2020 Framework Programme"},{"id":"https://openalex.org/G4012842235","display_name":null,"funder_award_id":"MSCA\u2010ITN\u20102020","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"},{"id":"https://openalex.org/G4123527056","display_name":null,"funder_award_id":"956172","funder_id":"https://openalex.org/F4320332999","funder_display_name":"Horizon 2020 Framework Programme"},{"id":"https://openalex.org/G4937468798","display_name":null,"funder_award_id":"H2020","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"},{"id":"https://openalex.org/G5998035708","display_name":null,"funder_award_id":"H2020-MSCA-ITN-2020","funder_id":"https://openalex.org/F4320332999","funder_display_name":"Horizon 2020 Framework Programme"},{"id":"https://openalex.org/G6004877412","display_name":"Enabling X-ray CT based Industry 4.0 process chains by training Next Generation research experts","funder_award_id":"956172","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"},{"id":"https://openalex.org/G6529851592","display_name":null,"funder_award_id":"H2020-MSCA-ITN-2020","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"},{"id":"https://openalex.org/G7984235579","display_name":null,"funder_award_id":"H2020-MSCA-ITN","funder_id":"https://openalex.org/F4320332999","funder_display_name":"Horizon 2020 Framework Programme"},{"id":"https://openalex.org/G8512683158","display_name":null,"funder_award_id":"H2020-MSCA","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"}],"funders":[{"id":"https://openalex.org/F4320320300","display_name":"European Commission","ror":"https://ror.org/00k4n6c32"},{"id":"https://openalex.org/F4320321800","display_name":"Nederlandse Organisatie voor Wetenschappelijk Onderzoek","ror":"https://ror.org/04jsz6e67"},{"id":"https://openalex.org/F4320332999","display_name":"Horizon 2020 Framework Programme","ror":"https://ror.org/00k4n6c32"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4383174304.pdf","grobid_xml":"https://content.openalex.org/works/W4383174304.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W4283314094","https://openalex.org/W2806741695","https://openalex.org/W4290647774","https://openalex.org/W3189286258","https://openalex.org/W3207797160","https://openalex.org/W3210364259","https://openalex.org/W4300558037","https://openalex.org/W2912112202","https://openalex.org/W2667207928","https://openalex.org/W4377864969"],"abstract_inverted_index":{"Abstract":[0],"Event":[1],"logs":[2,85],"are":[3],"widely":[4],"used":[5],"to":[6,48,98,147,192],"record":[7],"the":[8],"status":[9],"of":[10,127,157],"high-tech":[11],"systems,":[12],"making":[13],"log":[14,24,30,35,46,75,194],"anomaly":[15,25,76,101,138,195],"detection":[16,26,62,149,196],"important":[17],"for":[18,73,120,165,172],"monitoring":[19],"those":[20],"systems.":[21],"Most":[22],"existing":[23],"methods":[27],"take":[28],"a":[29,70,114,125,142,154],"event":[31,36,84],"count":[32],"matrix":[33],"or":[34,55,187],"sequences":[37],"as":[38,112,163],"input,":[39],"exploiting":[40],"quantitative":[41,54],"and/or":[42],"sequential":[43,56],"relationships":[44,57],"between":[45],"events":[47],"detect":[49],"anomalies.":[50],"However,":[51],"only":[52],"considering":[53],"may":[58],"result":[59],"in":[60,124,160],"low":[61],"accuracy.":[63,150],"To":[64],"alleviate":[65],"this":[66],"problem,":[67],"we":[68,104,152],"propose":[69],"graph-based":[71],"method":[72],"unsupervised":[74],"detection,":[77,139],"dubbed":[78],"Logs2Graphs":[79,184],",":[80],"which":[81],"first":[82],"converts":[83],"into":[86],"attributed,":[87,128],"directed,":[88,129],"and":[89,92,130,137],"weighted":[90,131],"graphs,":[91],"then":[93],"leverages":[94],"graph":[95,116,135],"neural":[96,117],"networks":[97],"perform":[99],"graph-level":[100,122],"detection.":[102],"Specifically,":[103],"introduce":[105],"One-Class":[106],"Digraph":[107],"Inception":[108],"Convolutional":[109],"Networks,":[110],"abbreviated":[111],"OCDiGCN,":[113],"novel":[115],"network":[118],"model":[119],"detecting":[121],"anomalies":[123],"collection":[126],"graphs.":[132],"By":[133],"integrating":[134],"representation":[136,144],"OCDiGCN":[140],"learns":[141],"specialized":[143],"that":[145,183],"leads":[146],"high":[148],"Crucially,":[151],"furnish":[153],"concise":[155],"set":[156],"nodes":[158],"pivotal":[159],"OCDiGCN\u2019s":[161],"prediction":[162],"explanations":[164],"each":[166],"detected":[167],"anomaly,":[168],"offering":[169],"valuable":[170],"insights":[171],"subsequent":[173],"root":[174],"cause":[175],"analysis.":[176],"Experiments":[177],"on":[178],"five":[179],"benchmark":[180],"datasets":[181],"show":[182],"exhibits":[185],"comparable":[186],"superior":[188],"performance":[189],"when":[190],"compared":[191],"state-of-the-art":[193],"methods.":[197]},"counts_by_year":[],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2025-10-10T00:00:00"}