{"id":"https://openalex.org/W3194035167","doi":"https://doi.org/10.1145/3468264.3473933","title":"An empirical investigation of practical log anomaly detection for online service systems","display_name":"An empirical investigation of practical log anomaly detection for online service systems","publication_year":2021,"publication_date":"2021-08-18","ids":{"openalex":"https://openalex.org/W3194035167","doi":"https://doi.org/10.1145/3468264.3473933","mag":"3194035167"},"language":"en","primary_location":{"id":"doi:10.1145/3468264.3473933","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3468264.3473933","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5102769427","display_name":"Nengwen Zhao","orcid":"https://orcid.org/0000-0002-5729-0884"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Nengwen Zhao","raw_affiliation_strings":["Tsinghua University, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100726967","display_name":"Honglin Wang","orcid":"https://orcid.org/0000-0002-4558-0489"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Honglin Wang","raw_affiliation_strings":["BizSeer, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"BizSeer, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5085631655","display_name":"Zeyan Li","orcid":"https://orcid.org/0000-0002-3529-5879"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zeyan Li","raw_affiliation_strings":["Tsinghua University, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101905583","display_name":"Xiao Peng","orcid":"https://orcid.org/0000-0003-3831-6927"},"institutions":[{"id":"https://openalex.org/I4210164792","display_name":"Everbright International (China)","ror":"https://ror.org/05tedyt08","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210164792"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiao Peng","raw_affiliation_strings":["China Everbright Bank, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"China Everbright Bank, China","institution_ids":["https://openalex.org/I4210164792"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100367403","display_name":"Gang Wang","orcid":"https://orcid.org/0000-0002-7266-2412"},"institutions":[{"id":"https://openalex.org/I4210164792","display_name":"Everbright International (China)","ror":"https://ror.org/05tedyt08","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210164792"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Gang Wang","raw_affiliation_strings":["China Everbright Bank, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"China Everbright Bank, China","institution_ids":["https://openalex.org/I4210164792"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100583076","display_name":"Pan Zhu","orcid":null},"institutions":[{"id":"https://openalex.org/I4210164792","display_name":"Everbright International (China)","ror":"https://ror.org/05tedyt08","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210164792"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhu Pan","raw_affiliation_strings":["China Everbright Bank, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"China Everbright Bank, China","institution_ids":["https://openalex.org/I4210164792"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101557853","display_name":"Yong Wu","orcid":"https://orcid.org/0000-0002-2244-5559"},"institutions":[{"id":"https://openalex.org/I4210164792","display_name":"Everbright International (China)","ror":"https://ror.org/05tedyt08","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210164792"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yong Wu","raw_affiliation_strings":["China Everbright Bank, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"China Everbright Bank, China","institution_ids":["https://openalex.org/I4210164792"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5050066561","display_name":"Zhen Feng","orcid":"https://orcid.org/0000-0003-1281-4522"},"institutions":[{"id":"https://openalex.org/I4210164792","display_name":"Everbright International (China)","ror":"https://ror.org/05tedyt08","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210164792"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhen Feng","raw_affiliation_strings":["China Everbright Bank, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"China Everbright Bank, China","institution_ids":["https://openalex.org/I4210164792"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5001239748","display_name":"Xidao Wen","orcid":"https://orcid.org/0000-0003-0527-947X"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xidao Wen","raw_affiliation_strings":["Tsinghua University, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101581273","display_name":"Wenchi Zhang","orcid":"https://orcid.org/0000-0002-5599-030X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wenchi Zhang","raw_affiliation_strings":["BizSeer, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"BizSeer, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063543200","display_name":"Kaixin Sui","orcid":"https://orcid.org/0000-0003-4545-7621"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kaixin Sui","raw_affiliation_strings":["BizSeer, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"BizSeer, China","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5046419834","display_name":"Dan Pei","orcid":"https://orcid.org/0000-0002-5113-838X"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Dan Pei","raw_affiliation_strings":["Tsinghua University, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University, China","institution_ids":["https://openalex.org/I99065089"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":12,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":6.7341,"has_fulltext":false,"cited_by_count":63,"citation_normalized_percentile":{"value":0.96967897,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"1404","last_page":"1415"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9907000064849854,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9904000163078308,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/interpretability","display_name":"Interpretability","score":0.8394744992256165},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7853925228118896},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.760535717010498},{"id":"https://openalex.org/keywords/reliability","display_name":"Reliability (semiconductor)","score":0.6196005344390869},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5623658895492554},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.5499054789543152},{"id":"https://openalex.org/keywords/variable","display_name":"Variable (mathematics)","score":0.5002422332763672},{"id":"https://openalex.org/keywords/service","display_name":"Service (business)","score":0.4831511378288269},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.4190613925457001},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.35682499408721924}],"concepts":[{"id":"https://openalex.org/C2781067378","wikidata":"https://www.wikidata.org/wiki/Q17027399","display_name":"Interpretability","level":2,"score":0.8394744992256165},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7853925228118896},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.760535717010498},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.6196005344390869},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5623658895492554},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.5499054789543152},{"id":"https://openalex.org/C182365436","wikidata":"https://www.wikidata.org/wiki/Q50701","display_name":"Variable (mathematics)","level":2,"score":0.5002422332763672},{"id":"https://openalex.org/C2780378061","wikidata":"https://www.wikidata.org/wiki/Q25351891","display_name":"Service (business)","level":2,"score":0.4831511378288269},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.4190613925457001},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.35682499408721924},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C26873012","wikidata":"https://www.wikidata.org/wiki/Q214781","display_name":"Condensed matter physics","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0},{"id":"https://openalex.org/C163258240","wikidata":"https://www.wikidata.org/wiki/Q25342","display_name":"Power (physics)","level":2,"score":0.0},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.0},{"id":"https://openalex.org/C136264566","wikidata":"https://www.wikidata.org/wiki/Q159810","display_name":"Economy","level":1,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3468264.3473933","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3468264.3473933","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"No poverty","id":"https://metadata.un.org/sdg/1","score":0.5600000023841858}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":37,"referenced_works":["https://openalex.org/W27994497","https://openalex.org/W1980931819","https://openalex.org/W1996289178","https://openalex.org/W2039157918","https://openalex.org/W2094924503","https://openalex.org/W2102632804","https://openalex.org/W2105454049","https://openalex.org/W2107263349","https://openalex.org/W2114131343","https://openalex.org/W2114554028","https://openalex.org/W2153470728","https://openalex.org/W2401686019","https://openalex.org/W2508465325","https://openalex.org/W2536393303","https://openalex.org/W2560021099","https://openalex.org/W2583874385","https://openalex.org/W2745980806","https://openalex.org/W2754665629","https://openalex.org/W2767094836","https://openalex.org/W2786827964","https://openalex.org/W2883560233","https://openalex.org/W2899279326","https://openalex.org/W2942544869","https://openalex.org/W2947815220","https://openalex.org/W2963999143","https://openalex.org/W2965838158","https://openalex.org/W2999013495","https://openalex.org/W2999825877","https://openalex.org/W3047008933","https://openalex.org/W3047409962","https://openalex.org/W3089718532","https://openalex.org/W3097861059","https://openalex.org/W3099780882","https://openalex.org/W3100214273","https://openalex.org/W3106543020","https://openalex.org/W4239205245","https://openalex.org/W4255845613"],"related_works":["https://openalex.org/W2806741695","https://openalex.org/W3210364259","https://openalex.org/W4290647774","https://openalex.org/W3189286258","https://openalex.org/W3207797160","https://openalex.org/W2912112202","https://openalex.org/W2667207928","https://openalex.org/W4300558037","https://openalex.org/W4377864969","https://openalex.org/W3030345572"],"abstract_inverted_index":{"Log":[0,23],"data":[1],"is":[2,26,221],"an":[3,95],"essential":[4],"and":[5,20,60,79,94,123,163,194,225],"valuable":[6],"resource":[7],"of":[8,16,70,84,177],"online":[9],"service":[10,29,236],"systems,":[11],"which":[12,32,157],"records":[13],"detailed":[14],"information":[15,109],"system":[17,150],"running":[18],"status":[19],"user":[21],"behavior.":[22],"anomaly":[24,148,160,212,230],"detection":[25,149,161,213,231],"vital":[27],"for":[28,223],"reliability":[30],"engineering,":[31],"has":[33],"been":[34],"extensively":[35],"studied.":[36],"However,":[37,126],"we":[38,88,143,188,204],"find":[39,104],"that":[40,105],"existing":[41,85,127],"approaches":[42,128,162],"suffer":[43],"from":[44],"several":[45],"limitations":[46],"when":[47],"deploying":[48],"them":[49],"into":[50],"practice,":[51],"including":[52],"1)":[53],"inability":[54],"to":[55,130,168,208,227,232,234],"deal":[56],"with":[57,107],"various":[58],"logs":[59,106],"complex":[61,133,170],"log":[62,147,211,229],"abnormal":[63,113,134],"patterns;":[64],"2)":[65],"poor":[66],"interpretability;":[67],"3)":[68],"lack":[69],"domain":[71,164],"knowledge.":[72],"To":[73,200],"help":[74],"understand":[75],"these":[76],"practical":[77,82,210],"challenges":[78],"investigate":[80,209],"the":[81,90,175,179,206,215],"performance":[83],"work":[86,220],"quantitatively,":[87],"conduct":[89],"first":[91,207],"empirical":[92],"study":[93,97],"experimental":[96],"based":[98,153],"on":[99,154],"large-scale":[100],"real-world":[101],"data.":[102],"We":[103],"rich":[108],"indeed":[110],"exhibit":[111],"diverse":[112],"patterns":[114],"(e.g.,":[115],"keywords,":[116],"template":[117,119],"count,":[118],"sequence,":[120],"variable":[121,124],"value,":[122],"distribution).":[125],"fail":[129],"tackle":[131],"such":[132],"patterns,":[135],"producing":[136],"unsatisfactory":[137],"performance.":[138],"Motivated":[139],"by":[140],"obtained":[141],"findings,":[142],"propose":[144],"a":[145],"generic":[146],"named":[151],"LogAD":[152],"ensemble":[155],"learning,":[156],"integrates":[158],"multiple":[159],"knowledge,":[165,203],"so":[166],"as":[167],"handle":[169],"situations":[171],"in":[172,214],"practice.":[173],"About":[174],"effectiveness":[176],"LogAD,":[178],"average":[180],"F1-score":[181],"achieves":[182],"0.83,":[183],"outperforming":[184],"all":[185],"baselines.":[186],"Besides,":[187],"also":[189],"share":[190],"some":[191],"success":[192],"cases":[193],"lessons":[195],"learned":[196],"during":[197],"our":[198,201],"study.":[199],"best":[202],"are":[205],"real":[216],"world":[217],"deeply.":[218],"Our":[219],"helpful":[222],"practitioners":[224],"researchers":[226],"apply":[228],"practice":[233],"enhance":[235],"reliability.":[237]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":17},{"year":2024,"cited_by_count":18},{"year":2023,"cited_by_count":19},{"year":2022,"cited_by_count":5}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}