{"id":"https://openalex.org/W2887332128","doi":"https://doi.org/10.1145/3230833.3230855","title":"Converting Unstructured System Logs into Structured Event List for Anomaly Detection","display_name":"Converting Unstructured System Logs into Structured Event List for Anomaly Detection","publication_year":2018,"publication_date":"2018-08-13","ids":{"openalex":"https://openalex.org/W2887332128","doi":"https://doi.org/10.1145/3230833.3230855","mag":"2887332128"},"language":"en","primary_location":{"id":"doi:10.1145/3230833.3230855","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3230833.3230855","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 13th International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5082612361","display_name":"Li Zongze","orcid":null},"institutions":[{"id":"https://openalex.org/I123534392","display_name":"University of North Texas","ror":"https://ror.org/00v97ad02","country_code":"US","type":"education","lineage":["https://openalex.org/I123534392"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zongze Li","raw_affiliation_strings":["Department of Computer Science and Engineering, University of North Texas"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, University of North Texas","institution_ids":["https://openalex.org/I123534392"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5071965993","display_name":"Matthew Davidson","orcid":"https://orcid.org/0000-0002-2088-040X"},"institutions":[{"id":"https://openalex.org/I123534392","display_name":"University of North Texas","ror":"https://ror.org/00v97ad02","country_code":"US","type":"education","lineage":["https://openalex.org/I123534392"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Matthew Davidson","raw_affiliation_strings":["Department of Computer Science and Engineering, University of North Texas"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, University of North Texas","institution_ids":["https://openalex.org/I123534392"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5082758762","display_name":"Song Fu","orcid":"https://orcid.org/0000-0002-7705-0829"},"institutions":[{"id":"https://openalex.org/I123534392","display_name":"University of North Texas","ror":"https://ror.org/00v97ad02","country_code":"US","type":"education","lineage":["https://openalex.org/I123534392"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Song Fu","raw_affiliation_strings":["Department of Computer Science and Engineering, University of North Texas"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, University of North Texas","institution_ids":["https://openalex.org/I123534392"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5036921385","display_name":"Sean Blanchard","orcid":"https://orcid.org/0000-0002-1119-7828"},"institutions":[{"id":"https://openalex.org/I1343871089","display_name":"Los Alamos National Laboratory","ror":"https://ror.org/01e41cf67","country_code":"US","type":"facility","lineage":["https://openalex.org/I1330989302","https://openalex.org/I1343871089","https://openalex.org/I198811213","https://openalex.org/I4210120050"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sean Blanchard","raw_affiliation_strings":["HPC-DES Group, and Computer, Computational, and Statistical Sciences Division, Los Alamos National Laboratory"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"HPC-DES Group, and Computer, Computational, and Statistical Sciences Division, Los Alamos National Laboratory","institution_ids":["https://openalex.org/I1343871089"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5078475557","display_name":"Michael Lang","orcid":"https://orcid.org/0000-0002-3498-6352"},"institutions":[{"id":"https://openalex.org/I1343871089","display_name":"Los Alamos National Laboratory","ror":"https://ror.org/01e41cf67","country_code":"US","type":"facility","lineage":["https://openalex.org/I1330989302","https://openalex.org/I1343871089","https://openalex.org/I198811213","https://openalex.org/I4210120050"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Michael Lang","raw_affiliation_strings":["HPC-DES Group, and Computer, Computational, and Statistical Sciences Division, Los Alamos National Laboratory"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"HPC-DES Group, and Computer, Computational, and Statistical Sciences Division, Los Alamos National Laboratory","institution_ids":["https://openalex.org/I1343871089"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.6785,"has_fulltext":false,"cited_by_count":5,"citation_normalized_percentile":{"value":0.63457877,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":96},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"10"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9973999857902527,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9973000288009644,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.7775341272354126},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7772083878517151},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6708003282546997},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.5977640151977539},{"id":"https://openalex.org/keywords/system-monitoring","display_name":"System monitoring","score":0.5441998839378357},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5399878025054932},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.471897691488266},{"id":"https://openalex.org/keywords/system-call","display_name":"System call","score":0.4698955714702606},{"id":"https://openalex.org/keywords/block","display_name":"Block (permutation group theory)","score":0.45101693272590637},{"id":"https://openalex.org/keywords/volume","display_name":"Volume (thermodynamics)","score":0.4423612356185913},{"id":"https://openalex.org/keywords/process-mining","display_name":"Process mining","score":0.4287070333957672},{"id":"https://openalex.org/keywords/line","display_name":"Line (geometry)","score":0.4257625937461853},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.3629456162452698},{"id":"https://openalex.org/keywords/distributed-computing","display_name":"Distributed computing","score":0.34996891021728516},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3446051776409149},{"id":"https://openalex.org/keywords/work-in-process","display_name":"Work in process","score":0.17588531970977783},{"id":"https://openalex.org/keywords/business-process","display_name":"Business process","score":0.12073898315429688},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.11971551179885864}],"concepts":[{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.7775341272354126},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7772083878517151},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6708003282546997},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5977640151977539},{"id":"https://openalex.org/C200749887","wikidata":"https://www.wikidata.org/wiki/Q1165574","display_name":"System monitoring","level":2,"score":0.5441998839378357},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5399878025054932},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.471897691488266},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.4698955714702606},{"id":"https://openalex.org/C2777210771","wikidata":"https://www.wikidata.org/wiki/Q4927124","display_name":"Block (permutation group theory)","level":2,"score":0.45101693272590637},{"id":"https://openalex.org/C20556612","wikidata":"https://www.wikidata.org/wiki/Q4469374","display_name":"Volume (thermodynamics)","level":2,"score":0.4423612356185913},{"id":"https://openalex.org/C124670913","wikidata":"https://www.wikidata.org/wiki/Q2608526","display_name":"Process mining","level":5,"score":0.4287070333957672},{"id":"https://openalex.org/C198352243","wikidata":"https://www.wikidata.org/wiki/Q37105","display_name":"Line (geometry)","level":2,"score":0.4257625937461853},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3629456162452698},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.34996891021728516},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3446051776409149},{"id":"https://openalex.org/C174998907","wikidata":"https://www.wikidata.org/wiki/Q357662","display_name":"Work in process","level":2,"score":0.17588531970977783},{"id":"https://openalex.org/C85345410","wikidata":"https://www.wikidata.org/wiki/Q851587","display_name":"Business process","level":3,"score":0.12073898315429688},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.11971551179885864},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C207505557","wikidata":"https://www.wikidata.org/wiki/Q4374012","display_name":"Business process modeling","level":4,"score":0.0},{"id":"https://openalex.org/C162853370","wikidata":"https://www.wikidata.org/wiki/Q39809","display_name":"Marketing","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C2524010","wikidata":"https://www.wikidata.org/wiki/Q8087","display_name":"Geometry","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3230833.3230855","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3230833.3230855","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 13th International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320306084","display_name":"U.S. Department of Energy","ror":"https://ror.org/01bj3aw27"},{"id":"https://openalex.org/F4320337506","display_name":"Advanced Scientific Computing Research","ror":"https://ror.org/0012c7r22"},{"id":"https://openalex.org/F4320338304","display_name":"Los Alamos National Laboratory","ror":"https://ror.org/01e41cf67"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":28,"referenced_works":["https://openalex.org/W65950392","https://openalex.org/W164902916","https://openalex.org/W191651381","https://openalex.org/W1491642720","https://openalex.org/W1581587400","https://openalex.org/W1608194207","https://openalex.org/W1661413208","https://openalex.org/W1880262756","https://openalex.org/W1968592943","https://openalex.org/W1975705975","https://openalex.org/W1990800901","https://openalex.org/W2032467893","https://openalex.org/W2040745298","https://openalex.org/W2044300056","https://openalex.org/W2064675550","https://openalex.org/W2072753962","https://openalex.org/W2102632804","https://openalex.org/W2107263349","https://openalex.org/W2107461003","https://openalex.org/W2115711419","https://openalex.org/W2152671254","https://openalex.org/W2164998314","https://openalex.org/W2171928131","https://openalex.org/W2203075298","https://openalex.org/W2278883498","https://openalex.org/W2585237296","https://openalex.org/W6607860712","https://openalex.org/W6668762651"],"related_works":["https://openalex.org/W2806741695","https://openalex.org/W4290647774","https://openalex.org/W3189286258","https://openalex.org/W3207797160","https://openalex.org/W11100131","https://openalex.org/W3210364259","https://openalex.org/W4300558037","https://openalex.org/W2912112202","https://openalex.org/W2667207928","https://openalex.org/W4377864969"],"abstract_inverted_index":{"System":[0,63],"logs":[1,34,104],"provide":[2],"invaluable":[3],"resources":[4],"for":[5,88],"understanding":[6],"system":[7,33,40,90,103,113,161,170],"behavior":[8,91,114],"and":[9,27,35,48,83,93,115,144,155,163,168,182,189],"detecting":[10],"anomalies":[11,118],"on":[12],"high":[13],"performance":[14,128],"computing":[15],"(HPC)":[16],"systems.":[17],"As":[18],"HPC":[19],"systems":[20],"continue":[21],"to":[22,166,187],"grow":[23],"in":[24,172],"both":[25],"scale":[26],"complexity,":[28],"the":[29,36,43,98,127,178],"sheer":[30],"volume":[31],"of":[32,73,111,129],"complex":[37],"interaction":[38],"among":[39],"components":[41],"make":[42],"traditional":[44],"manual":[45],"problem":[46],"diagnosis":[47],"even":[49],"automated":[50],"line-by-line":[51],"log":[52,74,149],"analysis":[53,92],"infeasible":[54],"or":[55],"ineffective.":[56],"In":[57],"this":[58],"paper,":[59],"we":[60,176],"present":[61],"a":[62,120],"Log":[64],"Event":[65],"Block":[66],"Detection":[67],"(SLEBD)":[68],"framework":[69,143],"that":[70,76,101,141],"identifies":[71],"groups":[72],"messages":[75],"follow":[77],"certain":[78],"sequence":[79],"but":[80],"with":[81,97],"variations,":[82],"explore":[84,183],"these":[85],"event":[86,153,180,191],"blocks":[87,154,181],"event-based":[89],"anomaly":[94],"detection.":[95],"Compared":[96],"existing":[99],"approaches":[100],"analyze":[102],"line":[105],"by":[106,131],"line,":[107],"SLEBD":[108,130],"is":[109],"capable":[110],"characterizing":[112],"identifying":[116],"intricate":[117],"at":[119],"higher":[121],"(i.e.,":[122],"event)":[123],"level.":[124],"We":[125],"evaluate":[126],"using":[132],"syslogs":[133],"collected":[134],"from":[135],"production":[136],"supercomputers.":[137],"Experimental":[138],"results":[139],"show":[140],"our":[142],"mechanisms":[145],"can":[146],"process":[147,169],"streaming":[148],"messages,":[150],"efficiently":[151],"extract":[152],"effectively":[156],"detect":[157],"anomalies,":[158],"which":[159],"enables":[160],"administrators":[162],"monitoring":[164],"tools":[165],"understand":[167],"events":[171],"real":[173],"time.":[174],"Additionally,":[175],"use":[177],"identified":[179],"deep":[184],"learning":[185],"algorithms":[186],"model":[188],"classify":[190],"sequences.":[192]},"counts_by_year":[{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":1},{"year":2020,"cited_by_count":2}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}