{"id":"https://openalex.org/W7138915700","doi":"https://doi.org/10.1186/s42400-026-00573-8","title":"LogLAA: an adaptive integrated log anomaly analysis framework","display_name":"LogLAA: an adaptive integrated log anomaly analysis framework","publication_year":2026,"publication_date":"2026-03-20","ids":{"openalex":"https://openalex.org/W7138915700","doi":"https://doi.org/10.1186/s42400-026-00573-8"},"language":"en","primary_location":{"id":"doi:10.1186/s42400-026-00573-8","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-026-00573-8","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-026-00573-8.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://link.springer.com/content/pdf/10.1186/s42400-026-00573-8.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5130052760","display_name":"Yali Gao","orcid":null},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Yali Gao","raw_affiliation_strings":["Key Laboratory of Trustworthy Distributed Computing and Service (BUPT), Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, 100876, China"],"affiliations":[{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service (BUPT), Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, 100876, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101291973","display_name":"Tianchao Luo","orcid":null},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tianchao Luo","raw_affiliation_strings":["Key Laboratory of Trustworthy Distributed Computing and Service (BUPT), Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, 100876, China"],"affiliations":[{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service (BUPT), Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, 100876, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5008625561","display_name":"Kangqian Huang","orcid":null},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]},{"id":"https://openalex.org/I4210137144","display_name":"Guangdong Hydropower Planning & Design Institute","ror":"https://ror.org/03bkmgf03","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210137144"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kangqian Huang","raw_affiliation_strings":["Guangdong Power Trading Center Co., Ltd, ITD, Guangzhou, Guangdong, 511510, China","Key Laboratory of Trustworthy Distributed Computing and Service (BUPT), Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, 100876, China"],"affiliations":[{"raw_affiliation_string":"Guangdong Power Trading Center Co., Ltd, ITD, Guangzhou, Guangdong, 511510, China","institution_ids":["https://openalex.org/I4210137144"]},{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service (BUPT), Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, 100876, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129859559","display_name":"Jialu Tang","orcid":null},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jialu Tang","raw_affiliation_strings":["Key Laboratory of Trustworthy Distributed Computing and Service (BUPT), Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, 100876, China"],"affiliations":[{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service (BUPT), Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, 100876, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5087915860","display_name":"Xiaoyong Li","orcid":"https://orcid.org/0000-0001-8450-625X"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaoyong Li","raw_affiliation_strings":["Key Laboratory of Trustworthy Distributed Computing and Service (BUPT), Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, 100876, China"],"affiliations":[{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service (BUPT), Ministry of Education, Beijing University of Posts and Telecommunications, Beijing, 100876, China","institution_ids":["https://openalex.org/I139759216"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5130052760"],"corresponding_institution_ids":["https://openalex.org/I139759216"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.70157929,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"9","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9934999942779541,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9934999942779541,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.0005000000237487257,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10799","display_name":"Data Visualization and Analytics","score":0.0005000000237487257,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/interpretability","display_name":"Interpretability","score":0.7451000213623047},{"id":"https://openalex.org/keywords/parsing","display_name":"Parsing","score":0.6735000014305115},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6658999919891357},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.6111999750137329},{"id":"https://openalex.org/keywords/prefix","display_name":"Prefix","score":0.5094000101089478},{"id":"https://openalex.org/keywords/word","display_name":"Word (group theory)","score":0.45500001311302185},{"id":"https://openalex.org/keywords/matching","display_name":"Matching (statistics)","score":0.42149999737739563},{"id":"https://openalex.org/keywords/time-complexity","display_name":"Time complexity","score":0.41769999265670776},{"id":"https://openalex.org/keywords/construct","display_name":"Construct (python library)","score":0.40389999747276306}],"concepts":[{"id":"https://openalex.org/C2781067378","wikidata":"https://www.wikidata.org/wiki/Q17027399","display_name":"Interpretability","level":2,"score":0.7451000213623047},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6984000205993652},{"id":"https://openalex.org/C186644900","wikidata":"https://www.wikidata.org/wiki/Q194152","display_name":"Parsing","level":2,"score":0.6735000014305115},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6658999919891357},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.6111999750137329},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.607200026512146},{"id":"https://openalex.org/C141603448","wikidata":"https://www.wikidata.org/wiki/Q134830","display_name":"Prefix","level":2,"score":0.5094000101089478},{"id":"https://openalex.org/C90805587","wikidata":"https://www.wikidata.org/wiki/Q10944557","display_name":"Word (group theory)","level":2,"score":0.45500001311302185},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.42149999737739563},{"id":"https://openalex.org/C311688","wikidata":"https://www.wikidata.org/wiki/Q2393193","display_name":"Time complexity","level":2,"score":0.41769999265670776},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.40389999747276306},{"id":"https://openalex.org/C2780598303","wikidata":"https://www.wikidata.org/wiki/Q65921492","display_name":"Flexibility (engineering)","level":2,"score":0.38260000944137573},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.38029998540878296},{"id":"https://openalex.org/C103278499","wikidata":"https://www.wikidata.org/wiki/Q254465","display_name":"Similarity (geometry)","level":3,"score":0.3792000114917755},{"id":"https://openalex.org/C112313634","wikidata":"https://www.wikidata.org/wiki/Q7886648","display_name":"Complement (music)","level":5,"score":0.3497999906539917},{"id":"https://openalex.org/C2780009758","wikidata":"https://www.wikidata.org/wiki/Q6804172","display_name":"Measure (data warehouse)","level":2,"score":0.3452000021934509},{"id":"https://openalex.org/C112972136","wikidata":"https://www.wikidata.org/wiki/Q7595718","display_name":"Stability (learning theory)","level":2,"score":0.33709999918937683},{"id":"https://openalex.org/C2778112365","wikidata":"https://www.wikidata.org/wiki/Q3511065","display_name":"Sequence (biology)","level":2,"score":0.33219999074935913},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.31029999256134033},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3068000078201294},{"id":"https://openalex.org/C2778029271","wikidata":"https://www.wikidata.org/wiki/Q5421931","display_name":"Extension (predicate logic)","level":2,"score":0.30140000581741333},{"id":"https://openalex.org/C68859911","wikidata":"https://www.wikidata.org/wiki/Q1503724","display_name":"Pattern matching","level":2,"score":0.27570000290870667},{"id":"https://openalex.org/C63553672","wikidata":"https://www.wikidata.org/wiki/Q581168","display_name":"Binary logarithm","level":2,"score":0.26989999413490295},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.26809999346733093},{"id":"https://openalex.org/C130318100","wikidata":"https://www.wikidata.org/wiki/Q2268914","display_name":"Semantic similarity","level":2,"score":0.2524999976158142}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1186/s42400-026-00573-8","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-026-00573-8","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-026-00573-8.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:14c5af5bd20249cca3ad96a30d4568d6","is_oa":true,"landing_page_url":"https://doaj.org/article/14c5af5bd20249cca3ad96a30d4568d6","pdf_url":null,"source":{"id":"https://openalex.org/S112646816","display_name":"SHILAP Revista de lepidopterolog\u00eda","issn_l":"0300-5267","issn":["0300-5267","2340-4078"],"is_oa":true,"is_in_doaj":true,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Cybersecurity, Vol 9, Iss 1 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1186/s42400-026-00573-8","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-026-00573-8","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-026-00573-8.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G3035818605","display_name":null,"funder_award_id":"2023YFB3107601","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"},{"id":"https://openalex.org/G6835212612","display_name":null,"funder_award_id":"No.2023YFB3107601","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"}],"funders":[{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7138915700.pdf","grobid_xml":"https://content.openalex.org/works/W7138915700.grobid-xml"},"referenced_works_count":32,"referenced_works":["https://openalex.org/W2015979301","https://openalex.org/W2114554028","https://openalex.org/W2208211896","https://openalex.org/W2583874385","https://openalex.org/W2754665629","https://openalex.org/W2767094836","https://openalex.org/W2947815220","https://openalex.org/W2963502184","https://openalex.org/W2963999143","https://openalex.org/W2965838158","https://openalex.org/W3021973688","https://openalex.org/W3134273251","https://openalex.org/W3152794541","https://openalex.org/W3156885949","https://openalex.org/W3212722888","https://openalex.org/W4214513770","https://openalex.org/W4224937983","https://openalex.org/W4226128225","https://openalex.org/W4292968359","https://openalex.org/W4367146761","https://openalex.org/W4376288669","https://openalex.org/W4385901046","https://openalex.org/W4388212317","https://openalex.org/W4394946189","https://openalex.org/W4396528511","https://openalex.org/W4398239377","https://openalex.org/W4398785907","https://openalex.org/W4403519963","https://openalex.org/W4404953656","https://openalex.org/W4411552577","https://openalex.org/W4412704026","https://openalex.org/W4413360391"],"related_works":[],"abstract_inverted_index":{"Abstract":[0],"Modern":[1],"systems":[2,95],"generate":[3],"massive":[4],"amounts":[5],"of":[6,48,57,153,160,200],"logs":[7],"during":[8],"operation,":[9],"which":[10,31],"are":[11],"the":[12,43,55,151,158,187,197,206],"key":[13],"foundation":[14],"for":[15,172],"anomaly":[16,154,161,191,212],"log":[17,25,49,58,68,81,94,179],"analysis.":[18,59,173,213],"However,":[19],"existing":[20],"research":[21],"typically":[22],"breaks":[23],"down":[24],"analysis":[26,69],"into":[27],"multiple":[28],"isolated":[29],"tasks,":[30],"lacks":[32],"flexibility":[33],"in":[34,92,106],"complex":[35],"application":[36],"scenarios":[37],"and":[38,46,66,86,103,113,125,133,136,190],"requires":[39],"significant":[40],"manpower.":[41],"Furthermore,":[42],"increasing":[44],"diversity":[45],"complexity":[47],"formats":[50],"place":[51],"higher":[52],"demands":[53],"on":[54,84,144],"accuracy":[56,124],"To":[60,156],"achieve":[61,122],"a":[62,80,117,140,145,167,183],"more":[63],"robust,":[64],"accurate,":[65],"comprehensive":[67],"method,":[70],"we":[71,121,148,163],"propose":[72],"an":[73,220],"integrated":[74],"framework,":[75],"called":[76],"LogLAA.":[77],"We":[78,127,204],"construct":[79],"parser":[82],"based":[83,143],"length":[85],"word":[87],"frequency":[88],"that":[89,177],"runs":[90],"stably":[91],"most":[93],"with":[96,116,139,166],"minimal":[97],"parameter":[98],"tuning,":[99],"supporting":[100],"both":[101],"offline":[102],"online":[104],"parsing":[105,180],"various":[107],"scenarios.":[108],"By":[109],"introducing":[110],"variable":[111],"substitution":[112],"combining":[114,137],"it":[115,218],"similarity":[118],"prefix":[119],"tree,":[120],"high":[123],"efficiency.":[126],"introduce":[128],"counting":[129],"embeddings,":[130,132,135],"sequence":[131],"semantic":[134],"them":[138,165],"CNN-LSTM":[141],"model":[142,170,189],"dual-attention":[146],"mechanism,":[147],"significantly":[149],"improve":[150],"precision":[152,199],"detection.":[155],"ensure":[157],"interpretability":[159],"logs,":[162],"combine":[164],"large":[168],"language":[169],"(LLM)":[171],"Experimental":[174],"results":[175],"show":[176],"our":[178],"method":[181],"achieves":[182,193],"0.8%":[184],"improvement":[185,195],"over":[186,196],"SOTA":[188],"detection":[192],"6%":[194],"average":[198],"other":[201],"advanced":[202],"methods.":[203],"use":[205],"weighted":[207],"matching":[208],"score":[209],"to":[210],"evaluate":[211],"LogLAA":[214],"scores":[215],"0.7,":[216],"placing":[217],"at":[219],"upper-middle":[221],"level.":[222]},"counts_by_year":[],"updated_date":"2026-04-10T15:06:20.359241","created_date":"2026-03-20T00:00:00"}