{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,15]],"date-time":"2024-09-15T05:18:11Z","timestamp":1726377491178},"reference-count":71,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2022,4,1]],"date-time":"2022-04-01T00:00:00Z","timestamp":1648771200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2022,4,1]],"date-time":"2022-04-01T00:00:00Z","timestamp":1648771200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2022,4,1]],"date-time":"2022-04-01T00:00:00Z","timestamp":1648771200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2022,4,1]],"date-time":"2022-04-01T00:00:00Z","timestamp":1648771200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2022,4,1]],"date-time":"2022-04-01T00:00:00Z","timestamp":1648771200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2022,4,1]],"date-time":"2022-04-01T00:00:00Z","timestamp":1648771200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Expert Systems with Applications"],"published-print":{"date-parts":[[2022,4]]},"DOI":"10.1016\/j.eswa.2021.116263","type":"journal-article","created":{"date-parts":[[2021,12,10]],"date-time":"2021-12-10T07:11:57Z","timestamp":1639120317000},"page":"116263","update-policy":"http:\/\/dx.doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":43,"special_numbering":"C","title":["AutoLog: Anomaly detection by deep autoencoding of system logs"],"prefix":"10.1016","volume":"191","author":[{"ORCID":"http:\/\/orcid.org\/0000-0002-5025-7969","authenticated-orcid":false,"given":"Marta","family":"Catillo","sequence":"first","affiliation":[]},{"given":"Antonio","family":"Pecchia","sequence":"additional","affiliation":[]},{"ORCID":"http:\/\/orcid.org\/0000-0001-5382-4650","authenticated-orcid":false,"given":"Umberto","family":"Villano","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"key":"10.1016\/j.eswa.2021.116263_b1","series-title":"Proc. conference on supercomputing","first-page":"1","article-title":"An overview of the BlueGene\/L supercomputer","author":"Adiga","year":"2002"},{"key":"10.1016\/j.eswa.2021.116263_b2","series-title":"Proc. long island systems, applications and technology conference","first-page":"1","article-title":"Comparison of autoencoder and principal component analysis followed by neural network for e-learning using handwritten recognition","author":"Almotiri","year":"2017"},{"key":"10.1016\/j.eswa.2021.116263_b3","series-title":"Proc. international conference on cyber security and cloud computing","first-page":"193","article-title":"Network anomaly detection with stochastically improved autoencoder based models","author":"Aygun","year":"2017"},{"key":"10.1016\/j.eswa.2021.116263_b4","series-title":"Proc. international symposium on software reliability engineering","first-page":"351","article-title":"Experience report: Log mining using natural language processing and application to anomaly detection","author":"Bertero","year":"2017"},{"issue":"5","key":"10.1016\/j.eswa.2021.116263_b5","doi-asserted-by":"crossref","first-page":"35","DOI":"10.1109\/MSP.2014.103","article-title":"The operational role of security information and event management systems","volume":"12","author":"Bhatt","year":"2014","journal-title":"IEEE Security & Privacy"},{"key":"10.1016\/j.eswa.2021.116263_b6","series-title":"Proc. European dependable computing conference","first-page":"9","article-title":"Exploratory study of machine learning techniques for supporting failure prediction","author":"Campos","year":"2018"},{"key":"10.1016\/j.eswa.2021.116263_b7","series-title":"Deep ROC analysis and AUC as balanced average accuracy to improve model selection, understanding and interpretation","author":"Carrington","year":"2021"},{"key":"10.1016\/j.eswa.2021.116263_b8","series-title":"Proc. web, artificial intelligence and network applications","first-page":"687","article-title":"2L-ZED-IDS: A two-level anomaly detector for multiple attack classes","author":"Catillo","year":"2020"},{"key":"10.1016\/j.eswa.2021.116263_b9","series-title":"Proc. SIAM international conference on data mining","first-page":"90","article-title":"Outlier detection with autoencoder ensembles","author":"Chen","year":"2017"},{"issue":"4","key":"10.1016\/j.eswa.2021.116263_b10","doi-asserted-by":"crossref","first-page":"1665","DOI":"10.1109\/TR.2016.2570564","article-title":"Characterizing direct monitoring techniques in software systems","volume":"65","author":"Cinque","year":"2016","journal-title":"IEEE Transactions on Reliability"},{"key":"10.1016\/j.eswa.2021.116263_b11","series-title":"Proc. international symposium on software reliability engineering workshops","first-page":"95","article-title":"Challenges and directions in security information and event management (SIEM)","author":"Cinque","year":"2018"},{"key":"10.1016\/j.eswa.2021.116263_b12","series-title":"Proc. conference on computer and communications security","first-page":"1285","article-title":"DeepLog: Anomaly detection and diagnosis from system logs through deep learning","author":"Du","year":"2017"},{"key":"10.1016\/j.eswa.2021.116263_b13","doi-asserted-by":"crossref","first-page":"101","DOI":"10.1016\/j.neunet.2017.09.004","article-title":"Post-boosting of classification boundary for imbalanced data using geometric mean","volume":"96","author":"Du","year":"2017","journal-title":"Neural Networks"},{"issue":"7","key":"10.1016\/j.eswa.2021.116263_b14","doi-asserted-by":"crossref","first-page":"3797","DOI":"10.1109\/TIT.2014.2320500","article-title":"R\u00e9nyi divergence and Kullback-Leibler divergence","volume":"60","author":"van Erven","year":"2014","journal-title":"IEEE Transactions on Information Theory"},{"key":"10.1016\/j.eswa.2021.116263_b15","series-title":"Proc. international conference on advanced communications technology","first-page":"178","article-title":"A deep auto-encoder based approach for intrusion detection system","author":"Fahimeh","year":"2018"},{"key":"10.1016\/j.eswa.2021.116263_b16","doi-asserted-by":"crossref","first-page":"531","DOI":"10.1016\/j.jss.2017.03.012","article-title":"Metric selection and anomaly detection for cloud operations using log and metric correlation analysis","volume":"137","author":"Farshchi","year":"2018","journal-title":"Journal of Systems and Software"},{"issue":"3","key":"10.1016\/j.eswa.2021.116263_b17","doi-asserted-by":"crossref","first-page":"229","DOI":"10.1016\/j.icte.2020.06.003","article-title":"Unsupervised log message anomaly detection","volume":"6","author":"Farzad","year":"2020","journal-title":"ICT Express"},{"key":"10.1016\/j.eswa.2021.116263_b18","series-title":"Log message anomaly detection and classification using auto-B\/LSTM and auto-GRU","author":"Farzad","year":"2021"},{"key":"10.1016\/j.eswa.2021.116263_b19","series-title":"Deep learning","author":"Goodfellow","year":"2016"},{"key":"10.1016\/j.eswa.2021.116263_b20","series-title":"LogBERT: Log anomaly detection via BERT","author":"Guo","year":"2021"},{"key":"10.1016\/j.eswa.2021.116263_b21","series-title":"Proc. international symposium on fault-tolerant computing","first-page":"221","article-title":"Models for time coalescence in event logs","author":"Hansen","year":"1992"},{"key":"10.1016\/j.eswa.2021.116263_b22","series-title":"OneLog: Towards end-to-end training in software log anomaly detection","author":"Hashemi","year":"2021"},{"key":"10.1016\/j.eswa.2021.116263_b23","series-title":"Proc. international conference on data warehousing and knowledge discovery","first-page":"170","article-title":"Outlier detection using replicator neural networks","author":"Hawkins","year":"2002"},{"key":"10.1016\/j.eswa.2021.116263_b24","series-title":"Proc. international conference on dependable systems and networks","first-page":"654","article-title":"An evaluation study on log parsing and its use in log mining","author":"He","year":"2016"},{"key":"10.1016\/j.eswa.2021.116263_b25","series-title":"Proc. international symposium on software reliability engineering","first-page":"207","article-title":"Experience report: System log analysis for anomaly detection","author":"He","year":"2016"},{"issue":"7","key":"10.1016\/j.eswa.2021.116263_b26","doi-asserted-by":"crossref","first-page":"1527","DOI":"10.1162\/neco.2006.18.7.1527","article-title":"A fast learning algorithm for deep belief nets","volume":"18","author":"Hinton","year":"2006","journal-title":"Neural Computation"},{"key":"10.1016\/j.eswa.2021.116263_b27","series-title":"Proc. HCI international - posters","first-page":"655","article-title":"Software log anomaly detection through one class clustering of transformer encoder representation","author":"Hirakawa","year":"2020"},{"key":"10.1016\/j.eswa.2021.116263_b28","series-title":"Interactive knowledge discovery and data mining in biomedical informatics: State-of-the-art and future challenges","first-page":"209","article-title":"On entropy-based data mining","author":"Holzinger","year":"2014"},{"key":"10.1016\/j.eswa.2021.116263_b29","doi-asserted-by":"crossref","DOI":"10.1016\/j.asoc.2019.106017","article-title":"APAD: Autoencoder-based payload anomaly detection for industrial IoE","volume":"88","author":"Kim","year":"2020","journal-title":"Applied Soft Computing"},{"issue":"4","key":"10.1016\/j.eswa.2021.116263_b30","doi-asserted-by":"crossref","first-page":"307","DOI":"10.1561\/2200000056","article-title":"An introduction to variational autoencoders","volume":"12","author":"Kingma","year":"2019","journal-title":"Foundations and Trends in Machine Learning"},{"key":"10.1016\/j.eswa.2021.116263_b31","series-title":"Proc. international symposium on software reliability engineering","first-page":"92","article-title":"SwissLog: Robust and unified deep learning based log anomaly detection for diverse faults","author":"Li","year":"2020"},{"key":"10.1016\/j.eswa.2021.116263_b32","series-title":"Proc. international conference on software engineering companion","first-page":"102","article-title":"Log clustering based problem identification for online service systems","author":"Lin","year":"2016"},{"key":"10.1016\/j.eswa.2021.116263_b33","doi-asserted-by":"crossref","DOI":"10.1016\/j.optlaseng.2020.106324","article-title":"Semi-supervised anomaly detection with dual prototypes autoencoder for industrial surface inspection","volume":"136","author":"Liu","year":"2021","journal-title":"Optics and Lasers in Engineering"},{"key":"10.1016\/j.eswa.2021.116263_b34","series-title":"Proc. international conference on data mining","first-page":"413","article-title":"Isolation forest","author":"Liu","year":"2008"},{"key":"10.1016\/j.eswa.2021.116263_b35","series-title":"Proc. internet measurement conference","first-page":"211","article-title":"Opprentice: Towards practical and automatic anomaly detection through machine learning","author":"Liu","year":"2015"},{"key":"10.1016\/j.eswa.2021.116263_b36","series-title":"Proc. international conference on web services","first-page":"389","article-title":"Log-based abnormal task detection and root cause analysis for spark","author":"Lu","year":"2017"},{"key":"10.1016\/j.eswa.2021.116263_b37","doi-asserted-by":"crossref","first-page":"411","DOI":"10.1016\/j.cose.2017.11.004","article-title":"UGR\u201916: A new dataset for the evaluation of cyclostationarity-based network IDSs","volume":"73","author":"Maci\u00e0-Fern\u00e1ndez","year":"2018","journal-title":"Computers & Security"},{"key":"10.1016\/j.eswa.2021.116263_b38","series-title":"Proc. international joint conf. on artificial intelligence","first-page":"4739","article-title":"LogAnomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs","author":"Meng","year":"2019"},{"key":"10.1016\/j.eswa.2021.116263_b39","series-title":"Security information and event management (SIEM) implementation","author":"Miller","year":"2010"},{"key":"10.1016\/j.eswa.2021.116263_b40","series-title":"Proc. conference on communications and network security","first-page":"91","article-title":"GEE: A gradient-based explainable variational autoencoder for network anomaly detection","author":"Nguyen","year":"2019"},{"issue":"2","key":"10.1016\/j.eswa.2021.116263_b41","doi-asserted-by":"crossref","first-page":"55","DOI":"10.1145\/2076450.2076466","article-title":"Advances and challenges in log analysis","volume":"55","author":"Oliner","year":"2012","journal-title":"Communications of the ACM"},{"key":"10.1016\/j.eswa.2021.116263_b42","series-title":"Proc. international conference on dependable systems and networks","first-page":"575","article-title":"What supercomputers say: A study of five system logs","author":"Oliner","year":"2007"},{"key":"10.1016\/j.eswa.2021.116263_b43","series-title":"Proc. international conference on dependable systems and networks","first-page":"45","article-title":"Detection of early-stage enterprise infection by mining large-scale log data","author":"Oprea","year":"2015"},{"issue":"2","key":"10.1016\/j.eswa.2021.116263_b44","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3439950","article-title":"Deep learning for anomaly detection: A review","volume":"54","author":"Pang","year":"2021","journal-title":"ACM Computing Surveys"},{"key":"10.1016\/j.eswa.2021.116263_b45","series-title":"Machine learning","first-page":"101","article-title":"Chapter 6 - Support vector machine","author":"Pisner","year":"2020"},{"key":"10.1016\/j.eswa.2021.116263_b46","series-title":"Proc. international conference on systems, man, and cybernetics","first-page":"2822","article-title":"Anomaly detection in distributed systems via variational autoencoders","author":"Qian","year":"2020"},{"issue":"5","key":"10.1016\/j.eswa.2021.116263_b47","doi-asserted-by":"crossref","first-page":"1009","DOI":"10.1109\/TPAMI.2010.154","article-title":"Term weighting schemes for question categorization","volume":"33","author":"Quan","year":"2011","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"key":"10.1016\/j.eswa.2021.116263_b48","unstructured":"Ruff, L., Vandermeulen, R. A., G\u00f6rnitz, N., Binder, A., M\u00fcller, E., & M\u00fcller, K. -R., et al. (2020). Deep semi-supervised anomaly detection. In Proc. international conference on learning representations."},{"key":"10.1016\/j.eswa.2021.116263_b49","series-title":"Cautionary tales: Stealth coordinated attack how to","author":"Ruiu","year":"1999"},{"key":"10.1016\/j.eswa.2021.116263_b50","series-title":"Proc. workshop on machine learning for sensory data analysis","first-page":"4","article-title":"Anomaly detection using autoencoders with nonlinear dimensionality reduction","author":"Sakurada","year":"2014"},{"issue":"5","key":"10.1016\/j.eswa.2021.116263_b51","doi-asserted-by":"crossref","first-page":"513","DOI":"10.1016\/0306-4573(88)90021-0","article-title":"Term-weighting approaches in automatic text retrieval","volume":"24","author":"Salton","year":"1988","journal-title":"Information Processing & Management"},{"issue":"7","key":"10.1016\/j.eswa.2021.116263_b52","doi-asserted-by":"crossref","first-page":"1443","DOI":"10.1162\/089976601750264965","article-title":"Estimating the support of a high-dimensional distribution","volume":"13","author":"Sch\u00f6lkopf","year":"2001","journal-title":"Neural Computing"},{"issue":"1","key":"10.1016\/j.eswa.2021.116263_b53","doi-asserted-by":"crossref","first-page":"41","DOI":"10.1109\/TETCI.2017.2772792","article-title":"A deep learning approach to network intrusion detection","volume":"2","author":"Shone","year":"2018","journal-title":"IEEE Transactions on Emerging Topics in Computational Intelligence"},{"key":"10.1016\/j.eswa.2021.116263_b54","series-title":"Introduction to deep learning: From logical calculus to artificial intelligence","first-page":"153","article-title":"Autoencoders","author":"Skansi","year":"2018"},{"key":"10.1016\/j.eswa.2021.116263_b55","series-title":"Progress in pattern recognition, image analysis, computer vision, and applications","first-page":"117","article-title":"Auto-encoder based data clustering","author":"Song","year":"2013"},{"key":"10.1016\/j.eswa.2021.116263_b56","series-title":"Proc. international symposium on cluster computing and the grid","first-page":"765","article-title":"Bad words: Finding faults in Spirit\u2019s syslogs","author":"Stearley","year":"2008"},{"key":"10.1016\/j.eswa.2021.116263_b57","series-title":"Proc. international conference on knowledge discovery & data mining","first-page":"2828","article-title":"Robust anomaly detection for multivariate time series through stochastic recurrent neural network","author":"Su","year":"2019"},{"key":"10.1016\/j.eswa.2021.116263_b58","series-title":"Proc. international conference on research in adaptive and convergent systems","first-page":"175","article-title":"On vulnerability and security log analysis: A systematic literature review on recent trends","author":"Svacina","year":"2020"},{"key":"10.1016\/j.eswa.2021.116263_b59","series-title":"Proc. international workshop on machine learning for signal processing","first-page":"1","article-title":"Fixing bias in reconstruction-based anomaly detection with Lipschitz discriminators","author":"Tong","year":"2020"},{"key":"10.1016\/j.eswa.2021.116263_b60","first-page":"3371","article-title":"Stacked denoising autoencoders: Learning useful representations in a deep network with a local denoising criterion","volume":"11","author":"Vincent","year":"2010","journal-title":"Journal of Machine Learning Research"},{"key":"10.1016\/j.eswa.2021.116263_b61","series-title":"Proc. international conference on computing, communication and networking technologies","first-page":"1","article-title":"Hybrid cae-vae for unsupervised anomaly detection in log file systems","author":"Wadekar","year":"2019"},{"key":"10.1016\/j.eswa.2021.116263_b62","doi-asserted-by":"crossref","first-page":"173827","DOI":"10.1109\/ACCESS.2019.2956494","article-title":"Outlier detection for monitoring data using stacked autoencoder","volume":"7","author":"Wan","year":"2019","journal-title":"IEEE Access"},{"key":"10.1016\/j.eswa.2021.116263_b63","series-title":"Experimentation in software engineering: An introduction","author":"Wohlin","year":"2000"},{"key":"10.1016\/j.eswa.2021.116263_b64","series-title":"Proc. tackling computer systems problems with machine learning techniques","first-page":"4","article-title":"Mining console logs for large-scale system problem detection","author":"Xu","year":"2008"},{"key":"10.1016\/j.eswa.2021.116263_b65","series-title":"Proc. international conference on reliability, infocom technologies and optimization (trends and future directions)","first-page":"1215","article-title":"A survey on log anomaly detection using deep learning","author":"Yadav","year":"2020"},{"key":"10.1016\/j.eswa.2021.116263_b66","doi-asserted-by":"crossref","first-page":"181152","DOI":"10.1109\/ACCESS.2019.2953981","article-title":"nLSALog: An anomaly detection framework for log sequence in security management","volume":"7","author":"Yang","year":"2019","journal-title":"IEEE Access"},{"key":"10.1016\/j.eswa.2021.116263_b67","series-title":"Proc. INFOCOM - conference on computer communications","first-page":"2449","article-title":"ADA: Adaptive deep log anomaly detector","author":"Yuan","year":"2020"},{"key":"10.1016\/j.eswa.2021.116263_b68","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2021.106748","article-title":"Unsupervised feature selection via transformed auto-encoder","volume":"215","author":"Zhang","year":"2021","journal-title":"Knowledge-Based Systems"},{"key":"10.1016\/j.eswa.2021.116263_b69","series-title":"Proc. international conference on big data","first-page":"1291","article-title":"Automated IT system failure prediction: A deep learning approach","author":"Zhang","year":"2016"},{"key":"10.1016\/j.eswa.2021.116263_b70","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2021.106756","article-title":"A conditional variational autoencoder based self-transferred algorithm for imbalanced classification","volume":"218","author":"Zhao","year":"2021","journal-title":"Knowledge-Based Systems"},{"key":"10.1016\/j.eswa.2021.116263_b71","series-title":"Computer safety, reliability, and security","first-page":"145","article-title":"Context-awareness to improve anomaly detection in dynamic service oriented architectures","author":"Zoppi","year":"2016"}],"container-title":["Expert Systems with Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0957417421015724?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0957417421015724?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2023,3,12]],"date-time":"2023-03-12T08:48:20Z","timestamp":1678610900000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0957417421015724"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,4]]},"references-count":71,"alternative-id":["S0957417421015724"],"URL":"https:\/\/doi.org\/10.1016\/j.eswa.2021.116263","relation":{},"ISSN":["0957-4174"],"issn-type":[{"value":"0957-4174","type":"print"}],"subject":[],"published":{"date-parts":[[2022,4]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"AutoLog: Anomaly detection by deep autoencoding of system logs","name":"articletitle","label":"Article Title"},{"value":"Expert Systems with Applications","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.eswa.2021.116263","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2021 Elsevier Ltd. All rights reserved.","name":"copyright","label":"Copyright"}],"article-number":"116263"}}