{"id":"https://openalex.org/W4391661511","doi":"https://doi.org/10.1109/tnsm.2024.3363626","title":"Few-Shot Log Anomaly Detection Based on Matching Networks","display_name":"Few-Shot Log Anomaly Detection Based on Matching Networks","publication_year":2024,"publication_date":"2024-02-08","ids":{"openalex":"https://openalex.org/W4391661511","doi":"https://doi.org/10.1109/tnsm.2024.3363626"},"language":"en","primary_location":{"id":"doi:10.1109/tnsm.2024.3363626","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2024.3363626","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5103837328","display_name":"Chunjing Han","orcid":null},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chunjing Han","raw_affiliation_strings":["Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-1990-0311","affiliations":[{"raw_affiliation_string":"Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103019787","display_name":"Bohai Guan","orcid":"https://orcid.org/0000-0002-2292-7777"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Bohai Guan","raw_affiliation_strings":["Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-2292-7777","affiliations":[{"raw_affiliation_string":"Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103009151","display_name":"Tong Li","orcid":null},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tong Li","raw_affiliation_strings":["Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-3470-7963","affiliations":[{"raw_affiliation_string":"Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005399769","display_name":"Di Kang","orcid":"https://orcid.org/0009-0003-9276-9174"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Di Kang","raw_affiliation_strings":["National Confidentiality Technology Evaluation Center, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0003-9276-9174","affiliations":[{"raw_affiliation_string":"National Confidentiality Technology Evaluation Center, Beijing, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043242671","display_name":"Jifeng Qin","orcid":"https://orcid.org/0000-0002-0964-8925"},"institutions":[{"id":"https://openalex.org/I92092256","display_name":"Huanghe Science and Technology College","ror":"https://ror.org/008p6rr25","country_code":"CN","type":"education","lineage":["https://openalex.org/I92092256"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jifeng Qin","raw_affiliation_strings":["Huanghe Science and Technology College, Zhengzhou, Henan, China"],"raw_orcid":"https://orcid.org/0000-0002-0964-8925","affiliations":[{"raw_affiliation_string":"Huanghe Science and Technology College, Zhengzhou, Henan, China","institution_ids":["https://openalex.org/I92092256"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5004458037","display_name":"Yulei Wu","orcid":"https://orcid.org/0000-0003-0801-8443"},"institutions":[{"id":"https://openalex.org/I36234482","display_name":"University of Bristol","ror":"https://ror.org/0524sp257","country_code":"GB","type":"education","lineage":["https://openalex.org/I36234482"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Yulei Wu","raw_affiliation_strings":["Faculty of Engineering, University of Bristol, Bristol, U.K"],"raw_orcid":"https://orcid.org/0000-0003-0801-8443","affiliations":[{"raw_affiliation_string":"Faculty of Engineering, University of Bristol, Bristol, U.K","institution_ids":["https://openalex.org/I36234482"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.7342,"has_fulltext":false,"cited_by_count":8,"citation_normalized_percentile":{"value":0.83659898,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":96,"max":99},"biblio":{"volume":"21","issue":"3","first_page":"2909","last_page":"2925"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9538999795913696,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.953000009059906,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7641074657440186},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.5946195125579834},{"id":"https://openalex.org/keywords/f1-score","display_name":"F1 score","score":0.5718669891357422},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.5593645572662354},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.495630145072937},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4860859215259552},{"id":"https://openalex.org/keywords/feature-extraction","display_name":"Feature extraction","score":0.4624974727630615},{"id":"https://openalex.org/keywords/generalization","display_name":"Generalization","score":0.44022250175476074},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.4211848974227905},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.12912708520889282}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7641074657440186},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5946195125579834},{"id":"https://openalex.org/C148524875","wikidata":"https://www.wikidata.org/wiki/Q6975395","display_name":"F1 score","level":2,"score":0.5718669891357422},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.5593645572662354},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.495630145072937},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4860859215259552},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.4624974727630615},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.44022250175476074},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4211848974227905},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.12912708520889282},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0},{"id":"https://openalex.org/C55493867","wikidata":"https://www.wikidata.org/wiki/Q7094","display_name":"Biochemistry","level":1,"score":0.0},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0},{"id":"https://openalex.org/C104317684","wikidata":"https://www.wikidata.org/wiki/Q7187","display_name":"Gene","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tnsm.2024.3363626","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2024.3363626","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G7720935500","display_name":null,"funder_award_id":"2022YFB3103402","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"}],"funders":[{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":42,"referenced_works":["https://openalex.org/W1614298861","https://openalex.org/W1919179112","https://openalex.org/W1990089904","https://openalex.org/W2096017373","https://openalex.org/W2107263349","https://openalex.org/W2114554028","https://openalex.org/W2115733720","https://openalex.org/W2527994611","https://openalex.org/W2626180518","https://openalex.org/W2754665629","https://openalex.org/W2806521373","https://openalex.org/W2896457183","https://openalex.org/W2911727988","https://openalex.org/W2912417536","https://openalex.org/W2920292591","https://openalex.org/W2947815220","https://openalex.org/W2952357537","https://openalex.org/W2963999143","https://openalex.org/W2971048662","https://openalex.org/W2986944522","https://openalex.org/W3034942609","https://openalex.org/W3104770333","https://openalex.org/W3128928262","https://openalex.org/W3152794541","https://openalex.org/W3156104344","https://openalex.org/W3168867926","https://openalex.org/W3199174176","https://openalex.org/W3209329320","https://openalex.org/W3212260481","https://openalex.org/W3216510157","https://openalex.org/W4312107845","https://openalex.org/W4379930814","https://openalex.org/W4385245566","https://openalex.org/W4388212456","https://openalex.org/W6636510571","https://openalex.org/W6681389334","https://openalex.org/W6755207826","https://openalex.org/W6764456104","https://openalex.org/W6766789251","https://openalex.org/W6776277508","https://openalex.org/W6796581206","https://openalex.org/W6848201473"],"related_works":["https://openalex.org/W3162204513","https://openalex.org/W2371138613","https://openalex.org/W2048963458","https://openalex.org/W43109613","https://openalex.org/W2359952343","https://openalex.org/W2239445980","https://openalex.org/W2080152487","https://openalex.org/W3083152911","https://openalex.org/W3022347918","https://openalex.org/W1996690921"],"abstract_inverted_index":{"In":[0,166,182],"order":[1],"to":[2,48,96,206],"address":[3],"the":[4,63,75,92,136,148,219,227],"problem":[5],"of":[6,138,164,180,198,221,229],"log":[7,15,24,34,46,50,93,106,185,232,239],"anomaly":[8,25,107],"detection":[9,26],"in":[10,91,105,110,133,178,214,223,226,238],"scenarios":[11],"with":[12,86,112,160,201],"limited":[13,113,230],"labeled":[14,114,231],"datasets,":[16],"this":[17],"paper":[18],"proposes":[19],"Log-MatchNet,":[20],"a":[21,84,129,143,211],"novel":[22],"few-shot":[23,167],"method.":[27],"To":[28],"tackle":[29],"issues":[30],"such":[31],"as":[32],"unstructured":[33],"data,":[35,140,194],"diversity,":[36],"and":[37,45,53,71,98,122,153,175,234],"evolution":[38,186,240],"over":[39],"time,":[40],"we":[41,81,141],"employ":[42],"structured":[43],"processing":[44],"parsing":[47],"convert":[49],"content":[51],"information":[52],"template":[54],"ID":[55],"into":[56],"vectors.":[57],"Feature":[58],"extraction":[59,89],"is":[60],"performed":[61],"using":[62],"BERT":[64,76],"model.":[65],"Additionally,":[66],"by":[67],"integrating":[68],"multiple":[69],"datasets":[70],"conducting":[72],"post-training":[73],"on":[74],"model":[77],"for":[78],"domain":[79],"adaptation,":[80],"obtain":[82],"BERT_Post,":[83],"module":[85],"universal":[87],"feature":[88],"capabilities":[90,159],"domain.":[94],"Compared":[95,205],"BERTbase":[97],"CyBERT,":[99],"our":[100,169,188,208],"method":[101,189],"demonstrates":[102],"superior":[103],"performance":[104,237],"detection,":[108],"especially":[109],"situations":[111],"datasets.":[115],"With":[116],"only":[117],"2":[118,123],"annotated":[119,124],"normal":[120],"logs":[121],"abnormal":[125],"logs,":[126],"BERT_Post":[127],"achieves":[128],"remarkable":[130],"16.14%":[131],"increase":[132,213],"F1-score.":[134,181,215],"Addressing":[135],"challenge":[137],"imbalanced":[139],"introduce":[142],"matching":[144],"network":[145,177],"that":[146],"learns":[147],"similarity":[149],"scores":[150],"between":[151],"input":[152],"prototype":[154],"vectors,":[155],"showcasing":[156],"strong":[157],"generalization":[158],"an":[161,183,196],"average":[162],"accuracy":[163],"99.6%.":[165],"scenarios,":[168],"method,":[170],"Log-MatchNet":[171,222],"outperforms":[172],"traditional":[173],"methods":[174],"Proto-Siamese":[176],"terms":[179],"unstable":[184],"environment,":[187],"exhibits":[190],"robustness":[191],"against":[192],"noisy":[193],"achieving":[195],"F1-score":[197],"81.2%":[199],"even":[200],"20%":[202],"injected":[203],"noise.":[204],"LogAnMeta,":[207],"approach":[209],"yields":[210],"31.71%":[212],"Experimental":[216],"results":[217],"demonstrate":[218],"effectiveness":[220],"detecting":[224],"anomalies":[225],"presence":[228],"data":[233],"its":[235],"robust":[236],"scenarios.":[241]},"counts_by_year":[{"year":2026,"cited_by_count":5},{"year":2025,"cited_by_count":3}],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}