{"id":"https://openalex.org/W4408353705","doi":"https://doi.org/10.1109/icassp49660.2025.10888663","title":"EagerLog: Active Learning Enhanced Retrieval Augmented Generation for Log-based Anomaly Detection","display_name":"EagerLog: Active Learning Enhanced Retrieval Augmented Generation for Log-based Anomaly Detection","publication_year":2025,"publication_date":"2025-03-12","ids":{"openalex":"https://openalex.org/W4408353705","doi":"https://doi.org/10.1109/icassp49660.2025.10888663"},"language":"en","primary_location":{"id":"doi:10.1109/icassp49660.2025.10888663","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icassp49660.2025.10888663","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ICASSP 2025 - 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5043852808","display_name":"Chiming Duan","orcid":"https://orcid.org/0009-0008-4422-6323"},"institutions":[{"id":"https://openalex.org/I20231570","display_name":"Peking University","ror":"https://ror.org/02v51f717","country_code":"CN","type":"education","lineage":["https://openalex.org/I20231570"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chiming Duan","raw_affiliation_strings":["Peking University,School of Software and Microelectronics,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Peking University,School of Software and Microelectronics,Beijing,China","institution_ids":["https://openalex.org/I20231570"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5069358025","display_name":"Tong Jia","orcid":"https://orcid.org/0000-0002-5946-9829"},"institutions":[{"id":"https://openalex.org/I20231570","display_name":"Peking University","ror":"https://ror.org/02v51f717","country_code":"CN","type":"education","lineage":["https://openalex.org/I20231570"]},{"id":"https://openalex.org/I4210100255","display_name":"Beijing Academy of Artificial Intelligence","ror":"https://ror.org/016a74861","country_code":"CN","type":"other","lineage":["https://openalex.org/I4210100255"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tong Jia","raw_affiliation_strings":["Peking University,Institute for Artificial Intelligence,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Peking University,Institute for Artificial Intelligence,Beijing,China","institution_ids":["https://openalex.org/I20231570","https://openalex.org/I4210100255"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100670362","display_name":"Yong Yang","orcid":"https://orcid.org/0000-0001-9667-2423"},"institutions":[{"id":"https://openalex.org/I20231570","display_name":"Peking University","ror":"https://ror.org/02v51f717","country_code":"CN","type":"education","lineage":["https://openalex.org/I20231570"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yong Yang","raw_affiliation_strings":["Peking University,National Engineering Research Center for Software Engineering,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Peking University,National Engineering Research Center for Software Engineering,Beijing,China","institution_ids":["https://openalex.org/I20231570"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5081766211","display_name":"Guiyang Liu","orcid":"https://orcid.org/0009-0000-3383-9409"},"institutions":[{"id":"https://openalex.org/I45928872","display_name":"Alibaba Group (China)","ror":"https://ror.org/00k642b80","country_code":"CN","type":"company","lineage":["https://openalex.org/I45928872"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guiyang Liu","raw_affiliation_strings":["Alibaba Cloud Computing Company,Hangzhou,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Alibaba Cloud Computing Company,Hangzhou,China","institution_ids":["https://openalex.org/I45928872"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5017058942","display_name":"Jinbu Liu","orcid":"https://orcid.org/0009-0003-6149-2651"},"institutions":[{"id":"https://openalex.org/I45928872","display_name":"Alibaba Group (China)","ror":"https://ror.org/00k642b80","country_code":"CN","type":"company","lineage":["https://openalex.org/I45928872"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jinbu Liu","raw_affiliation_strings":["Alibaba Cloud Computing Company,Hangzhou,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Alibaba Cloud Computing Company,Hangzhou,China","institution_ids":["https://openalex.org/I45928872"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5065561980","display_name":"Huxing Zhang","orcid":"https://orcid.org/0009-0007-1761-9044"},"institutions":[{"id":"https://openalex.org/I45928872","display_name":"Alibaba Group (China)","ror":"https://ror.org/00k642b80","country_code":"CN","type":"company","lineage":["https://openalex.org/I45928872"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Huxing Zhang","raw_affiliation_strings":["Alibaba Cloud Computing Company,Hangzhou,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Alibaba Cloud Computing Company,Hangzhou,China","institution_ids":["https://openalex.org/I45928872"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100617023","display_name":"Qi Zhou","orcid":"https://orcid.org/0000-0002-6549-9362"},"institutions":[{"id":"https://openalex.org/I45928872","display_name":"Alibaba Group (China)","ror":"https://ror.org/00k642b80","country_code":"CN","type":"company","lineage":["https://openalex.org/I45928872"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qi Zhou","raw_affiliation_strings":["Alibaba Cloud Computing Company,Hangzhou,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Alibaba Cloud Computing Company,Hangzhou,China","institution_ids":["https://openalex.org/I45928872"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100414277","display_name":"Ying Li","orcid":"https://orcid.org/0000-0002-6278-2357"},"institutions":[{"id":"https://openalex.org/I20231570","display_name":"Peking University","ror":"https://ror.org/02v51f717","country_code":"CN","type":"education","lineage":["https://openalex.org/I20231570"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ying Li","raw_affiliation_strings":["Peking University,National Engineering Research Center for Software Engineering,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Peking University,National Engineering Research Center for Software Engineering,Beijing,China","institution_ids":["https://openalex.org/I20231570"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5040160424","display_name":"Gang Huang","orcid":"https://orcid.org/0000-0001-5909-7714"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gang Huang","raw_affiliation_strings":["National Key Laboratory of Data Space Technology and System,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Key Laboratory of Data Space Technology and System,Beijing,China","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":9,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"5"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9804999828338623,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9502000212669373,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7005580067634583},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.5401754379272461},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3701680302619934},{"id":"https://openalex.org/keywords/information-retrieval","display_name":"Information retrieval","score":0.32773557305336}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7005580067634583},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5401754379272461},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3701680302619934},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.32773557305336}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/icassp49660.2025.10888663","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icassp49660.2025.10888663","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ICASSP 2025 - 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":31,"referenced_works":["https://openalex.org/W1972020324","https://openalex.org/W2413458763","https://openalex.org/W2754665629","https://openalex.org/W2755791218","https://openalex.org/W2756452435","https://openalex.org/W2767094836","https://openalex.org/W2769838334","https://openalex.org/W2947815220","https://openalex.org/W2965838158","https://openalex.org/W3034999214","https://openalex.org/W3099700870","https://openalex.org/W3100214273","https://openalex.org/W3205626500","https://openalex.org/W3210131940","https://openalex.org/W4211008139","https://openalex.org/W4239205245","https://openalex.org/W4255845613","https://openalex.org/W4386858668","https://openalex.org/W4388212578","https://openalex.org/W4388212671","https://openalex.org/W4393141466","https://openalex.org/W4393147129","https://openalex.org/W4399631359","https://openalex.org/W4401113920","https://openalex.org/W4404782964","https://openalex.org/W6779985061","https://openalex.org/W6782482366","https://openalex.org/W6783758335","https://openalex.org/W6838865847","https://openalex.org/W6856800273","https://openalex.org/W6863671552"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2001405890","https://openalex.org/W4396696052"],"abstract_inverted_index":{"Logs":[0],"record":[1],"essential":[2],"information":[3],"about":[4],"system":[5],"operations":[6],"and":[7,47,71,116,129],"serve":[8],"as":[9],"a":[10,28,85],"critical":[11],"source":[12,115],"for":[13,33,100],"anomaly":[14,35,88],"detection,":[15],"which":[16,65],"has":[17],"generated":[18],"growing":[19],"research":[20],"interest.":[21],"Utilizing":[22],"large":[23],"language":[24],"models":[25],"(LLMs)":[26],"within":[27,73],"retrieval-augmented":[29],"generation":[30],"(RAG)":[31],"framework":[32],"log-based":[34,87],"detection":[36,89],"is":[37],"an":[38],"effective":[39],"approach":[40],"due":[41],"to":[42,96,102,107],"its":[43,118],"strong":[44],"generalization":[45],"capabilities":[46],"efficient":[48],"few-shot":[49],"performance.":[50],"However,":[51],"the":[52,59,62,74,98,108,113],"effectiveness":[53],"of":[54,61],"this":[55,81],"method":[56,90],"hinges":[57],"on":[58,122],"quality":[60],"knowledge":[63,109,114],"source,":[64,110],"can":[66,136],"be":[67],"impacted":[68],"by":[69,150],"noise":[70],"changes":[72],"software":[75],"systems.":[76],"Facing":[77],"these":[78],"problems,":[79],"in":[80],"paper,":[82],"we":[83],"propose":[84],"novel":[86],"named":[91],"EagerLog,":[92],"employing":[93],"active":[94],"learning":[95],"choose":[97],"logs":[99],"humans":[101],"label,":[103],"thereby":[104],"adding":[105],"them":[106],"thus":[111],"enhancing":[112],"maintaining":[117],"quality.":[119],"Our":[120],"experiments":[121],"three":[123],"open":[124],"datasets":[125],"(BGL,":[126],"Thunderbird,":[127],"Zookeeper)":[128],"one":[130],"industrial":[131],"dataset":[132],"demonstrate":[133],"that":[134],"EagerLog":[135],"achieve":[137],"93.65%":[138],"F1":[139],"score":[140],"with":[141],"approximately":[142],"10":[143],"labeled":[144],"log":[145],"sequences,":[146],"surpassing":[147],"existing":[148],"methods":[149],"15.32%.":[151]},"counts_by_year":[{"year":2026,"cited_by_count":5},{"year":2025,"cited_by_count":4}],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}