{"id":"https://openalex.org/W4390187567","doi":"https://doi.org/10.1109/qrs60937.2023.00012","title":"Log-based Anomaly Detection of Enterprise Software: An Empirical Study","display_name":"Log-based Anomaly Detection of Enterprise Software: An Empirical Study","publication_year":2023,"publication_date":"2023-10-22","ids":{"openalex":"https://openalex.org/W4390187567","doi":"https://doi.org/10.1109/qrs60937.2023.00012"},"language":"en","primary_location":{"id":"doi:10.1109/qrs60937.2023.00012","is_oa":false,"landing_page_url":"https://doi.org/10.1109/qrs60937.2023.00012","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE 23rd International Conference on Software Quality, Reliability, and Security (QRS)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Nadun Wijesinghe","orcid":null},"institutions":[{"id":"https://openalex.org/I168635309","display_name":"University of Calgary","ror":"https://ror.org/03yjb2x39","country_code":"CA","type":"education","lineage":["https://openalex.org/I168635309"]}],"countries":["CA"],"is_corresponding":true,"raw_author_name":"Nadun Wijesinghe","raw_affiliation_strings":["University of Calgary,Calgary,AB,Canada","University of Calgary, Calgary, AB, Canada"],"affiliations":[{"raw_affiliation_string":"University of Calgary,Calgary,AB,Canada","institution_ids":["https://openalex.org/I168635309"]},{"raw_affiliation_string":"University of Calgary, Calgary, AB, Canada","institution_ids":["https://openalex.org/I168635309"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5070634219","display_name":"Hadi Hemmati","orcid":"https://orcid.org/0000-0003-0204-9812"},"institutions":[{"id":"https://openalex.org/I192455969","display_name":"York University","ror":"https://ror.org/05fq50484","country_code":"CA","type":"education","lineage":["https://openalex.org/I192455969"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Hadi Hemmati","raw_affiliation_strings":["York University,Toronto,ON,Canada","York University, Toronto, ON, Canada"],"affiliations":[{"raw_affiliation_string":"York University,Toronto,ON,Canada","institution_ids":["https://openalex.org/I192455969"]},{"raw_affiliation_string":"York University, Toronto, ON, Canada","institution_ids":["https://openalex.org/I192455969"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I168635309"],"apc_list":null,"apc_paid":null,"fwci":0.7916,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.75032945,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"12","last_page":"23"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.994700014591217,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.9919000267982483,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6095041632652283},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5748565196990967},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.495293527841568},{"id":"https://openalex.org/keywords/empirical-research","display_name":"Empirical research","score":0.4888684153556824},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.4206530451774597},{"id":"https://openalex.org/keywords/enterprise-software","display_name":"Enterprise software","score":0.41697075963020325},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.32581186294555664},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.28129205107688904},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.24844852089881897},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.18062353134155273},{"id":"https://openalex.org/keywords/statistics","display_name":"Statistics","score":0.09284660220146179},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.06840524077415466}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6095041632652283},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5748565196990967},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.495293527841568},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.4888684153556824},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.4206530451774597},{"id":"https://openalex.org/C185765463","wikidata":"https://www.wikidata.org/wiki/Q1318054","display_name":"Enterprise software","level":2,"score":0.41697075963020325},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.32581186294555664},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.28129205107688904},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.24844852089881897},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.18062353134155273},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.09284660220146179},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.06840524077415466},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/qrs60937.2023.00012","is_oa":false,"landing_page_url":"https://doi.org/10.1109/qrs60937.2023.00012","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE 23rd International Conference on Software Quality, Reliability, and Security (QRS)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":35,"referenced_works":["https://openalex.org/W1184354083","https://openalex.org/W1540258466","https://openalex.org/W1591888204","https://openalex.org/W1965626898","https://openalex.org/W2039157918","https://openalex.org/W2094924503","https://openalex.org/W2114554028","https://openalex.org/W2120416238","https://openalex.org/W2143522309","https://openalex.org/W2214658311","https://openalex.org/W2401686019","https://openalex.org/W2508465325","https://openalex.org/W2560021099","https://openalex.org/W2583874385","https://openalex.org/W2729350029","https://openalex.org/W2754665629","https://openalex.org/W2767094836","https://openalex.org/W2775696952","https://openalex.org/W2883560233","https://openalex.org/W2898998129","https://openalex.org/W2900353077","https://openalex.org/W2903478803","https://openalex.org/W2947815220","https://openalex.org/W2956106249","https://openalex.org/W2965838158","https://openalex.org/W2998908795","https://openalex.org/W3013882983","https://openalex.org/W3036573764","https://openalex.org/W3187841728","https://openalex.org/W3199174176","https://openalex.org/W4226128225","https://openalex.org/W4239762439","https://openalex.org/W4243521886","https://openalex.org/W6632550495","https://openalex.org/W6635271661"],"related_works":["https://openalex.org/W2806741695","https://openalex.org/W4290647774","https://openalex.org/W3189286258","https://openalex.org/W3207797160","https://openalex.org/W3210364259","https://openalex.org/W4300558037","https://openalex.org/W2912112202","https://openalex.org/W2667207928","https://openalex.org/W4377864969","https://openalex.org/W2972971679"],"abstract_inverted_index":{"Most":[0],"enterprise":[1],"applications":[2],"use":[3],"logging":[4,95],"as":[5,80],"a":[6,111,180,186],"mechanism":[7],"to":[8,241],"diagnose":[9],"anomalies,":[10,163],"which":[11,104,139],"could":[12],"help":[13],"with":[14,94,110,185],"reducing":[15],"system":[16],"downtime.":[17],"Anomaly":[18],"detection":[19,67,129],"using":[20,31,50],"software":[21],"execution":[22],"logs":[23],"has":[24,46],"been":[25,75],"explored":[26],"in":[27,49,77,92,190,219],"several":[28,126],"prior":[29,192],"studies,":[30],"both":[32],"classical":[33],"and":[34,61,143,214],"deep":[35,54],"neural":[36,55],"network-based":[37],"machine":[38],"learning":[39],"models.":[40],"In":[41,82,121],"recent":[42],"years,":[43],"the":[44,84,108,200,205,208,217,228,237,244,250],"research":[45,137],"largely":[47],"focused":[48],"variations":[51],"of":[52,161,199,216,223,230],"sequence-based":[53],"networks":[56],"(e.g.,":[57],"Long-Short":[58],"Term":[59],"Memory":[60],"Transformer-based":[62],"models)":[63],"for":[64,169],"log-based":[65],"anomaly":[66,128],"on":[68,131,207,249],"open-source":[69,86,150],"data.":[70],"However,":[71],"they":[72],"have":[73],"not":[74,99,106],"applied":[76],"industrial":[78,115,133,209],"datasets,":[79],"often.":[81],"addition,":[83],"studied":[85],"datasets":[87],"are":[88,159,166],"typically":[89],"very":[90],"large":[91,148],"size":[93],"statements":[96],"that":[97,117,155,175],"do":[98],"change":[100],"much":[101,141],"over":[102],"time,":[103],"may":[105],"be":[107],"case":[109],"dataset":[112,134,210],"from":[113,135],"an":[114,132],"service":[116],"is":[118,140,194],"relatively":[119],"new.":[120],"this":[122],"paper,":[123],"we":[124,226],"evaluate":[125,242],"state-of-the-art":[127],"models":[130,158,165,218],"our":[136],"partner,":[138],"smaller":[142],"loosely":[144],"structured":[145],"than":[146],"most":[147],"scale":[149],"benchmark":[151],"datasets.":[152,171],"Results":[153],"show":[154],"while":[156],"all":[157],"capable":[160],"detecting":[162,220],"certain":[164],"better":[167],"suited":[168],"less-structured":[170],"We":[172],"also":[173],"see":[174],"model":[176,245],"effectiveness":[177,246],"changes":[178],"when":[179],"common":[181],"data":[182,233],"leak":[183],"associated":[184],"random":[187],"train-test":[188],"split":[189],"some":[191],"work":[193],"removed.":[195],"A":[196],"qualitative":[197],"study":[198],"defects\u2019":[201],"characteristics":[202],"identified":[203],"by":[204,234],"developers":[206],"further":[211],"shows":[212],"strengths":[213],"weaknesses":[215],"different":[221],"types":[222],"anomalies.":[224],"Finally,":[225],"explore":[227],"effect":[229],"limited":[231],"training":[232,238,251],"gradually":[235],"increasing":[236],"set":[239,252],"size,":[240],"if":[243],"does":[247],"depend":[248],"size.":[253]},"counts_by_year":[{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":1}],"updated_date":"2026-04-17T18:11:37.981687","created_date":"2025-10-10T00:00:00"}