{"id":"https://openalex.org/W7123735605","doi":"https://doi.org/10.1109/access.2026.3653996","title":"DualBERT: Fusing Symbolic and Temporal Dynamics for High-Precision Log Anomaly Detection","display_name":"DualBERT: Fusing Symbolic and Temporal Dynamics for High-Precision Log Anomaly Detection","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7123735605","doi":"https://doi.org/10.1109/access.2026.3653996"},"language":null,"primary_location":{"id":"doi:10.1109/access.2026.3653996","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3653996","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2026.3653996","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5046570668","display_name":"Ahmed Alzamil","orcid":"https://orcid.org/0000-0002-1542-5939"},"institutions":[{"id":"https://openalex.org/I4210088963","display_name":"University of Ha'il","ror":"https://ror.org/013w98a82","country_code":"SA","type":"education","lineage":["https://openalex.org/I4210088963"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Ahmed Alzamil","raw_affiliation_strings":["Department of Electrical Engineering, College of Engineering, University of Ha’il, Hail, Saudi Arabia"],"raw_orcid":"https://orcid.org/0000-0002-1542-5939","affiliations":[{"raw_affiliation_string":"Department of Electrical Engineering, College of Engineering, University of Ha’il, Hail, Saudi Arabia","institution_ids":["https://openalex.org/I4210088963"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5045754914","display_name":"Ramzi Guesmi","orcid":"https://orcid.org/0000-0001-8759-0151"},"institutions":[{"id":"https://openalex.org/I142899784","display_name":"University of Sfax","ror":"https://ror.org/04d4sd432","country_code":"TN","type":"education","lineage":["https://openalex.org/I142899784"]}],"countries":["TN"],"is_corresponding":false,"raw_author_name":"Ramzi Guesmi","raw_affiliation_strings":["Laboratory of Electronics and Information Technology, National Engineering School of Sfax, University of Sfax, Sfax, Tunisia"],"raw_orcid":"https://orcid.org/0000-0001-8759-0151","affiliations":[{"raw_affiliation_string":"Laboratory of Electronics and Information Technology, National Engineering School of Sfax, University of Sfax, Sfax, Tunisia","institution_ids":["https://openalex.org/I142899784"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5012890444","display_name":"Amer AlGhadhban","orcid":"https://orcid.org/0000-0003-4350-2759"},"institutions":[{"id":"https://openalex.org/I4210088963","display_name":"University of Ha'il","ror":"https://ror.org/013w98a82","country_code":"SA","type":"education","lineage":["https://openalex.org/I4210088963"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Amer Alghadhban","raw_affiliation_strings":["Department of Electrical Engineering, College of Engineering, University of Ha’il, Hail, Saudi Arabia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Electrical Engineering, College of Engineering, University of Ha’il, Hail, Saudi Arabia","institution_ids":["https://openalex.org/I4210088963"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5065455920","display_name":"Tawfik Guesmi","orcid":"https://orcid.org/0000-0001-8221-2610"},"institutions":[{"id":"https://openalex.org/I4210088963","display_name":"University of Ha'il","ror":"https://ror.org/013w98a82","country_code":"SA","type":"education","lineage":["https://openalex.org/I4210088963"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Tawfik Guesmi","raw_affiliation_strings":["Department of Electrical Engineering, College of Engineering, University of Ha’il, Hail, Saudi Arabia"],"raw_orcid":"https://orcid.org/0000-0001-8221-2610","affiliations":[{"raw_affiliation_string":"Department of Electrical Engineering, College of Engineering, University of Ha’il, Hail, Saudi Arabia","institution_ids":["https://openalex.org/I4210088963"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5003921571","display_name":"Abdennaceur Kachouri","orcid":"https://orcid.org/0000-0003-3357-2569"},"institutions":[{"id":"https://openalex.org/I142899784","display_name":"University of Sfax","ror":"https://ror.org/04d4sd432","country_code":"TN","type":"education","lineage":["https://openalex.org/I142899784"]}],"countries":["TN"],"is_corresponding":false,"raw_author_name":"Abdennaceur Kachouri","raw_affiliation_strings":["AFD2E Laboratory, National Engineering School of Sfax, University of Sfax, Sfax, Tunisia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"AFD2E Laboratory, National Engineering School of Sfax, University of Sfax, Sfax, Tunisia","institution_ids":["https://openalex.org/I142899784"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.04271075,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"14","issue":null,"first_page":"11369","last_page":"11384"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.996999979019165,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.996999979019165,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.0005000000237487257,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.0003000000142492354,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7735000252723694},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.6380000114440918},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.5982000231742859},{"id":"https://openalex.org/keywords/temporal-database","display_name":"Temporal database","score":0.4641000032424927},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.44850000739097595},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.4250999987125397},{"id":"https://openalex.org/keywords/data-modeling","display_name":"Data modeling","score":0.41609999537467957},{"id":"https://openalex.org/keywords/sequence","display_name":"Sequence (biology)","score":0.4138999879360199}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7735000252723694},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7450000047683716},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.6380000114440918},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.5982000231742859},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5221999883651733},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5055000185966492},{"id":"https://openalex.org/C77277458","wikidata":"https://www.wikidata.org/wiki/Q1969246","display_name":"Temporal database","level":2,"score":0.4641000032424927},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.44850000739097595},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.4250999987125397},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.41609999537467957},{"id":"https://openalex.org/C2778112365","wikidata":"https://www.wikidata.org/wiki/Q3511065","display_name":"Sequence (biology)","level":2,"score":0.4138999879360199},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.40059998631477356},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3919000029563904},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3677000105381012},{"id":"https://openalex.org/C66322947","wikidata":"https://www.wikidata.org/wiki/Q11658","display_name":"Transformer","level":3,"score":0.328900009393692},{"id":"https://openalex.org/C111335779","wikidata":"https://www.wikidata.org/wiki/Q3454686","display_name":"Reduction (mathematics)","level":2,"score":0.32010000944137573},{"id":"https://openalex.org/C16101541","wikidata":"https://www.wikidata.org/wiki/Q1350838","display_name":"Symbolic dynamics","level":2,"score":0.2840000092983246},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.2786000072956085},{"id":"https://openalex.org/C136389625","wikidata":"https://www.wikidata.org/wiki/Q334384","display_name":"Supervised learning","level":3,"score":0.2526000142097473},{"id":"https://openalex.org/C148524875","wikidata":"https://www.wikidata.org/wiki/Q6975395","display_name":"F1 score","level":2,"score":0.25110000371932983}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/access.2026.3653996","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3653996","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1109/access.2026.3653996","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3653996","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.5553976893424988,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":44,"referenced_works":["https://openalex.org/W2039157918","https://openalex.org/W2754665629","https://openalex.org/W2767094836","https://openalex.org/W2896827527","https://openalex.org/W2944851425","https://openalex.org/W2947411064","https://openalex.org/W2947815220","https://openalex.org/W2949676527","https://openalex.org/W2965838158","https://openalex.org/W2982145560","https://openalex.org/W3041148953","https://openalex.org/W3089718532","https://openalex.org/W3095840026","https://openalex.org/W3127712067","https://openalex.org/W3163667769","https://openalex.org/W3188723794","https://openalex.org/W4205965165","https://openalex.org/W4226128225","https://openalex.org/W4295127058","https://openalex.org/W4312975905","https://openalex.org/W4328028653","https://openalex.org/W4366091323","https://openalex.org/W4366988472","https://openalex.org/W4382725253","https://openalex.org/W4385605314","https://openalex.org/W4387546413","https://openalex.org/W4387609326","https://openalex.org/W4387805051","https://openalex.org/W4388212665","https://openalex.org/W4391558391","https://openalex.org/W4393158805","https://openalex.org/W4395005317","https://openalex.org/W4399625707","https://openalex.org/W4402159050","https://openalex.org/W4402742611","https://openalex.org/W4403868549","https://openalex.org/W4405362546","https://openalex.org/W4405812162","https://openalex.org/W4406363472","https://openalex.org/W4407128202","https://openalex.org/W4409569048","https://openalex.org/W4409581319","https://openalex.org/W4412939627","https://openalex.org/W4415125459"],"related_works":[],"abstract_inverted_index":{"Anomaly":[0],"detection":[1],"in":[2,26,36,92,233,243],"system":[3,272],"logs":[4,78],"has":[5],"attracted":[6],"considerable":[7],"interest":[8],"with":[9,256],"the":[10,32,86,93,112,116,145,201,218,244],"development":[11],"of":[12,70,82,115,176,214],"deep":[13],"learning":[14],"and":[15,20,53,88,95,153,170,196,239,270],"big":[16],"data.":[17],"Many":[18],"methods":[19],"approaches":[21],"have":[22],"achieved":[23],"good":[24],"results":[25,206,249],"log":[27,37,66],"anomaly":[28,174,276],"detection,":[29],"but":[30],"exploiting":[31],"rich":[33,62],"dependencies":[34],"hidden":[35],"data":[38],"remains":[39],"an":[40,159,183,211,262],"extremely":[41],"challenging":[42],"task.":[43],"Recently,":[44],"Transformer-based":[45],"models,":[46],"such":[47,166],"as":[48,79,167],"LogBERT,":[49],"represent":[50],"a":[51,80,105,124,135,139,151,188,194,230,240,267],"strong":[52],"promising":[54],"foundation":[55],"thanks":[56],"to":[57,60,104,128,143,186,229,237,265],"their":[58],"ability":[59],"capture":[61],"contextual":[63],"information":[64,90],"within":[65],"sequences.":[67],"The":[68,173],"limitation":[69,101],"these":[71],"models":[72,178],"is":[73,226,261],"that":[74,162,208,251],"they":[75],"mainly":[76,227],"treat":[77],"sequence":[81,254],"discrete":[83],"tokens,":[84],"neglecting":[85],"crucial":[87],"continuous":[89],"embedded":[91],"temporal":[94,168],"numerical":[96],"dynamics":[97],"between":[98],"events.":[99],"This":[100,224],"can":[102],"lead":[103],"high":[106],"false":[107,245],"positive":[108,246],"rate,":[109],"thus":[110],"reducing":[111],"practical":[113,271],"utility":[114],"model.":[117],"In":[118],"this":[119,130],"work,":[120],"we":[121],"propose":[122],"DualBERT,":[123],"hybrid":[125],"framework":[126],"designed":[127],"address":[129],"gap.":[131],"Our":[132,205,248],"approach":[133],"leverages":[134],"dual-model":[136],"architecture:":[137],"1)":[138],"primary":[140],"Transformer":[141],"(LogBERT)":[142],"analyze":[144],"log\u2019s":[146],"symbolic":[147,253],"key":[148],"sequence;":[149],"2)":[150],"parallel":[152],"specialized":[154],"parameter":[155],"model":[156],"represented":[157],"by":[158],"LSTM-based":[160],"regressor":[161],"analyzes":[163],"inter-event":[164,258],"features":[165],"deltas":[169],"cyclic":[171],"patterns.":[172],"scores":[175],"both":[177],"are":[179],"then":[180],"fused":[181],"using":[182],"XGBoost":[184],"classifier":[185],"produce":[187],"final":[189],"robust":[190],"decision.":[191],"We":[192],"conduct":[193],"rigorous":[195],"fully":[197],"supervised":[198],"evaluation":[199],"on":[200],"HDFS":[202],"benchmark":[203,222],"dataset.":[204],"demonstrate":[207],"DualBERT":[209],"achieves":[210],"F1":[212],"score":[213],"98.75%,":[215],"significantly":[216],"surpassing":[217],"satisfactorily":[219],"evaluated":[220],"LogBERT":[221],"(98.29%).":[223],"improvement":[225],"due":[228],"substantial":[231],"increase":[232],"accuracy":[234],"(from":[235],"96.64%":[236],"97.70%)":[238],"43%":[241],"reduction":[242],"rate.":[247],"confirm":[250],"merging":[252],"analysis":[255],"dedicated":[257],"dynamic":[259],"modeling":[260],"effective":[263],"strategy":[264],"create":[266],"more":[268],"reliable":[269],"for":[273],"real-world":[274],"logarithmic":[275],"detection.":[277]},"counts_by_year":[],"updated_date":"2026-01-28T23:14:49.684275","created_date":"2026-01-14T00:00:00"}