LogTinyLLM: Tiny Large Language Models Based Contextual Log Anomaly Detection

Isaiah Thompson Ocansey; Ritwik Bhattacharya; Tanmay Sen

REVIEW 4 major objections 6 minor 18 references

LogTinyLLM: Tiny Large Language Models Based Contextual Log Anomaly Detection

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read LoRA fine-tuning of tiny language models beats LogBERT full fine-tuning by 18–19 percentage points on the Thunderbird log anomaly detection task.

desk verdict A useful LoRA parameter scan on Thunderbird, but the headline 18-19 point gain over LogBERT is not yet supported because the evaluation protocol and threshold calibration are missing. read the letter →

arxiv 2507.11071 v1 pith:ZIMGEHK3 submitted 2025-07-15 cs.LG cs.AIcs.CV

Isaiah Thompson Ocansey , Ritwik Bhattacharya , Tanmay Sen This is my paper · ORCID

classification cs.LGcs.AIcs.CV

keywords loganomalydetectionLoRAparameter-efficientfine-tuningtinylanguagemodelsThunderbirddatasetadaptermodulessequenceclassificationsystemlogs

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that parameter-efficient fine-tuning, specifically LoRA, lets tiny pretrained language models detect anomalies in system log sequences far better than full fine-tuning of a larger BERT-based model. On the Thunderbird supercomputer log dataset, LoRA-tuned models such as DeepSeek-R1-Distill-Qwen-1.5B reach 97.76–98.83% accuracy and F1 scores near 98.5%, while the LogBERT baseline gets 79.37% accuracy and 66.02% F1. The paper also tests a lightweight adapter variant with only two trainable linear layers, which reaches 84–88% accuracy. A sympathetic reader would care because the result points to a low-cost path to accurate log anomaly detection: freeze a small model and train only a few added parameters.

What carries the argument

The core mechanism is LoRA's low-rank update to the attention projections. For each target projection, the pretrained weight matrix $W$ is frozen and the effective matrix becomes $W + \Delta W = W + \alpha B A$, where $A$ is initialized randomly, $B$ is initialized to zero, and the product has rank $r \ll d$ (here $r=2$, $\alpha=16$). The paper applies this to the query, key, and value projections separately and trains only the $A$, $B$ matrices plus a classification head. The adapter variant instead freezes the entire transformer, mean-pools the last hidden states, and trains two ReLU linear layers followed by a two-class head. Inputs to both come from raw Thunderbird logs parsed into log keys by Drain and grouped into sliding-window sequences.

What would settle it

Run LogBERT and the best LoRA configuration (rank 2, $\alpha=16$, kproj only) on the same Thunderbird subset with a fixed train/validation/test split, window size, sequence length, and class weights. If LogBERT's accuracy rises to the LoRA level or LoRA's drops below roughly 95% under that shared protocol, the claimed 18–19 point advantage is not reproducible.

Watch

Extended reading notes

Core claim

The central claim is that LoRA-based fine-tuning of tiny LLMs outperforms LogBERT full fine-tuning by 18–19 percentage points in accuracy on the Thunderbird dataset, with the best configuration being a single LoRA module applied only to the key projection of DeepSeek-R1-Distill-Qwen-1.5B, achieving 98.83% accuracy and 98.56% F1. All LoRA-tuned tiny models (Phi-1.5, OPT-1.3B, TinyLlama-1.1B) land between 97.76% and 98.83% accuracy, while the adapter-based variant reaches 84–88% accuracy, about ten F1 points below LoRA but still above LogBERT. In the paper's telling, full fine-tuning of a larger model is unnecessary: freezing a small model and training a tiny set of added parameters is both cheaper and more accurate on this task.

Load-bearing premise

The load-bearing premise is that the LoRA runs and the LogBERT baseline were evaluated under the same train/test split, windowing, and sequence-length protocol; the paper does not report these details, so if the baseline was run under different conditions the 18–19 point improvement would not be a fair comparison.

Editorial extensions

If this is right

A single LoRA module on the key projection is enough for near-peak accuracy; adding value or query modules gives no consistent gain across models.
Sub-2B-parameter models fine-tuned with LoRA can exceed 98% accuracy and 98% F1 on Thunderbird, outperforming the 110M-parameter LogBERT baseline by a wide margin.
Adapter-based PEFT, with only two trainable linear layers, reaches 84–88% accuracy and beats LogBERT on the same dataset, though it trails LoRA by about 10 F1 points.
Because the frozen backbone is never updated, the memory and compute footprint of training is limited to the low-rank matrices and the head, which is the paper's stated route to deployment with limited resources.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: if the LoRA-versus-LogBERT comparison survives a shared, pre-registered evaluation protocol, parameter-efficient tuning of small models could become the default baseline for log anomaly detection, not merely a cheaper alternative.
Editorial inference: the 'optimal single-module kproj' choice is selected from the same table used to report final numbers, so a holdout or fixed-protocol replication is needed to rule out validation-selection effects; this is not addressed in the paper.
Editorial inference: the method is phrased generically over parsed log-key sequences, so the same LoRA recipe should transfer to other public log corpora (HDFS, BGL, Liberty); a cross-dataset run would test whether the 18–19 point gain is specific to Thunderbird.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: this is a small empirical paper, not a new framework. It compares LoRA and adapter fine-tuning of four 1-1.5B decoder models on Thunderbird log anomaly detection, with a target-module scan (kproj, k+v, k+q+v). The best numbers are strong: up to 98.83% accuracy and 98.56% F1 for a single kproj LoRA on DeepSeek-R1-Distill-Qwen-1.5B. That is a practically useful datapoint for low-resource monitoring, and the scan pattern is useful: single-module beats triple-module, and adapters lag LoRA by about 10 F1 points. The hyperparameters are listed, the algorithms are standard and correctly described, and the paper does not oversell adapters.

What worries me is the experimental protocol, or rather its absence. There is no train/validation/test split, no window size, no sequence length, no class distribution, no repetition count, no error bars. The 'optimal' single-module kproj configuration is selected from the same results table as the reported numbers, so it is a validation selection at best. The LogBERT baseline is a single operating point: precision 92.03, recall 51.47. That shape is exactly what you expect from a poorly calibrated threshold on an imbalanced dataset. The paper never says how LogBERT's threshold was set, whether it was tuned on a validation set, or how it compares with the default 0.5 threshold used by the LoRA classifier head in Algorithm 1. If LogBERT's threshold were chosen with the same care, its recall could rise substantially and the F1 gap could shrink. The 18-19 point claim is therefore not yet attributable to LoRA versus full fine-tuning; it may be a calibration artifact. The stress-test note lands.

There are also minor issues: the reference list includes irrelevant web forum and blog entries, and two near-duplicate LogBERT citations. That is sloppy but not fatal.

Overall, the paper is coherent, the measurements are plausible, and the comparison is worth making. But the central claim, as stated in the abstract, is not supported by the reported evidence. This is a fixable paper: add the full protocol, release code and data splits, report repeated runs with error bars, and calibrate the LogBERT threshold at the same operating point as the LoRA models. If the authors do that, the 18-19 point result is believable and publishable as an application paper. I would not desk-reject it, but I would send it back for major revision.

Referee Report

4 major / 6 minor

Summary. The paper proposes two parameter-efficient fine-tuning (PEFT) approaches, LoRA and adapter modules, applied to several small pretrained language models (OPT-1.3B, Phi-1.5, TinyLlama-1.1B, DeepSeek-R1-Distill-Qwen-1.5B) for contextual log anomaly detection on the Thunderbird dataset. The central claim, stated in the abstract and Section 4.2, is that LoRA-based fine-tuning improves accuracy by 18 to 19 percentage points over a LogBERT full-fine-tuning baseline, reaching 97.76--98.83% accuracy and F1 scores of 97.98--98.57%, whereas LogBERT achieves 79.37% accuracy and 66.02% F1. The paper also reports adapter-based results, which are lower than LoRA but still above LogBERT on most metrics. The authors conclude that LoRA applied to a single attention projection offers the best performance/efficiency trade-off and that DeepSeek-R1-Distill-Qwen-1.5B is the best-performing model.

Significance. If the reported comparison is trustworthy, the result is a useful empirical contribution: it would show that parameter-efficient tuning of small language models can match or exceed full fine-tuning of a larger BERT-based model at lower training cost for log anomaly detection. The paper has concrete strengths: it uses a public dataset (Thunderbird/LogHub), compares against an independently published baseline (LogBERT), provides algorithmic descriptions of both PEFT methods, and reports hyperparameters such as rank, scaling factor, learning rate, and epochs. However, the significance of the headline claim depends entirely on the evaluation protocol, which the manuscript does not describe in sufficient detail; the current evidence is therefore suggestive rather than conclusive.

major comments (4)

[§4.2, Table 1] The central 18--19 percentage point claim rests on an unverified assumption that the LoRA models and the LogBERT baseline are evaluated at equivalent operating points. LogBERT is reported with precision 92.03% and recall 51.47%, a pattern typical of a poorly calibrated decision threshold for an imbalanced binary task. The paper never states how LogBERT's anomaly-score threshold was chosen, whether it was tuned on a validation set, or how it relates to the learned binary classifier head used for the LoRA models in Algorithm 1. Without reporting ROC/PR curves, threshold-selection criteria, or at minimum the same validation-based threshold tuning for both methods, the 30-point F1 gap cannot be attributed to LoRA versus full fine-tuning rather than to threshold calibration.
[§4.2, Table 1] The paper does not report the train/validation/test split, sliding-window size, sequence length, class distribution, or number of runs for any experiment. The 'optimal' single-module kproj configuration is selected from the same results table used to report final performance, with no indication of a separate held-out test set. This means the top LoRA numbers may be validation selections, and the small differences among LoRA configurations (e.g., 98.56% versus 98.35% F1) may be within run-to-run noise. The evaluation protocol must be specified, including dataset partitioning, window parameters, repetition counts, and variance estimates, before the headline comparison can be assessed.
[§4.1, §2.1] The dataset preprocessing is described only at a high level. The paper states that Drain parses logs into log keys and that sequences are formed with a sliding window, but it does not specify the Drain parameters, window size, stride, or how a sequence is labeled as normal versus anomalous given that individual log entries are labeled by the presence or absence of a '-' prefix. Sequence-level labeling rules and the resulting class balance are essential for interpreting accuracy and F1 in this setting, especially because LogBERT's recall is 51.47% and the dataset is known to be highly imbalanced. These details should be provided.
[Algorithms 1 and 2] The comparison between the proposed methods and LogBERT is not specified as a controlled experiment. Algorithm 1 uses a weighted cross-entropy loss with weights w_c, and Algorithm 2 also references w_c, but the weights are never defined. It is also unclear whether LogBERT was retrained under the same data split, window size, and loss weighting, or whether the published LogBERT numbers were taken from the original paper. Without stating exactly how the baseline was trained and evaluated under the same protocol, the claimed improvement may reflect differences in experimental setup rather than in the PEFT methods themselves.

minor comments (6)

[Abstract] There are several typos: 'volumne', 'seqeunce', and 'finetuing' should be corrected.
[§3.1, Eq. (1)] The LoRA update is written as W_adapted = W + alpha * B_l * A_l with B_l = 0 and A_l ~ N(0, sigma^2). Standard LoRA initializes A with Gaussian draws and B with zeros so that the update starts at zero; the text as written sets the entire product to zero and makes the distribution of A irrelevant. Please correct the initialization description and the direction of the low-rank factors.
[Table 1] The dagger symbol after LogBERT has no corresponding footnote, and the 'Loss' column does not state whether the reported loss is training loss, validation loss, or test loss; Section 4.2 later refers to 'lowest validation loss' without connecting it to the table.
[Table 2] F1-score values are reported inconsistently: Table 1 uses percentages (e.g., 98.56%), while Table 2 uses decimals (e.g., 0.8669). Please use one consistent format.
[References] Reference [10] ('Attention is all you need') is listed twice, and LogBERT is listed as both [11] and [14]. Some references are non-archival or informal (e.g., [1] MoldStud and [15] Naked Scientists forum) and should be replaced with peer-reviewed or arXiv sources where possible.
[Figure 2] Figure 2 has no error bars, no indication of the number of runs, and no caption describing the exact configuration or evaluation split; adding these would make the figure informative rather than a summary of Table 1.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper reports empirical benchmark measurements against an external dataset and an independently published baseline, with no self-referential derivation chain.

full rationale

The paper makes no theoretical derivation; its central claim is an empirical comparison of LoRA and adapter fine-tuning of tiny LLMs against a LogBERT full-fine-tuning baseline on the Thunderbird dataset. The result is measured, not derived from an equation that embeds the conclusion. The LoRA update rule (W_adapted = W + alpha * B*A, with B initialized to zero) is the standard LoRA formulation, and the baseline LogBERT numbers are presented as an external comparison rather than being constructed from the LoRA predictions. No fitted parameter is renamed as a prediction, and no load-bearing claim is justified by a self-citation: the authors do not cite their own prior work, and the cited LogBERT, LoRA, and dataset sources are external. The selection of the best LoRA configuration from the same results table and the absence of a stated evaluation protocol are evaluation-validity concerns, not circularity: they call into question whether the 18-19 point gap is an artifact of threshold choice or data-split differences, but they do not reduce the reported outcome to its own inputs by construction. Therefore, under the circularity criteria, the paper is self-contained as a benchmark study and should receive a score of 0.

Assumptions & free parameters 7 free parameters · 4 assumptions · 0 invented entities

The central claim depends on several hand-chosen hyperparameters (rank, alpha, LR, epochs, batch size, window size, adapter hidden size) and on domain assumptions about the Thunderbird labels, Drain parsing, and mean pooling. No new entities are postulated. The most consequential free choice, the selection of the kproj-only LoRA configuration as 'optimal,' is made after seeing the results.

free parameters (7)

LoRA rank r = 2
Fixed by hand for all LoRA runs; no sweep reported (Table 1 footnote).
LoRA scaling factor alpha = 16
Fixed for all LoRA runs; not tuned.
Learning rate = 5e-5
Chosen for all runs; no LR schedule described.
Number of epochs = 3
Fixed for all LoRA runs; no early stopping.
Batch size = 2
Fixed for all LoRA runs.
Sliding window size / sequence length = Not reported
Used to form log sequences in Section 2.1 but never stated; a free choice that materially changes the task.
Adapter hidden size = Not reported
Algorithm 2 defines W1, W2 as dhidden x dhidden but dhidden is never specified.

assumptions (4)

domain assumption Thunderbird label rule is valid: entries starting with '-' are normal and others are abnormal.
Section 4.1 states the rule and the experiments treat it as ground truth.
domain assumption Drain parsing produces log keys that preserve anomaly-relevant information.
Section 2.1 relies on Drain with no evaluation of parsing fidelity.
domain assumption Mean-pooling token hidden states preserves the anomalous signal.
Algorithm 2 uses mean pooling; no ablation of alternative pooling is given.
domain assumption Pretrained tiny LLM representations transfer to log key sequences with only PEFT.
The method assumes the frozen weights encode useful semantics for log text; no analysis supports this.

how reviews work

0 comments

Cite this review

Pith. "Pith review of LogTinyLLM: Tiny Large Language Models Based Contextual Log Anomaly Detection." pith.science (2026). https://pith.science/paper/ZIMGEHK3

@misc{pith2026250711071,
  author       = {Pith},
  title        = {Pith review of: LogTinyLLM: Tiny Large Language Models Based Contextual Log Anomaly Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZIMGEHK3}},
  note         = {Machine review of arXiv:2507.11071}
}

read the original abstract

Log anomaly detection using traditional rule based or deep learning based methods is often challenging due to the large volume and highly complex nature of log sequence. So effective way of detection of anomalous sequence of logs is crucial for system maintenance and development. This paper proposes parameter efficient finetuning specifically low rank adaptation (LoRA) and adapter based approaches for finding contextual anomalies in sequence of logs in large log data set. It compares different tiny large language models (LLMs) on the Thunderbird dataset. The results show that LoRA based finetuning provides substantial performance improvements of 18 to 19 percentage over LogBert based full finetuning approach, achieving accuracy scores between 97.76% and 98.83% compared to 79.37%.

Figures

Figures reproduced from arXiv: 2507.11071 by the authors.

**Figure 1.** LoRA architecture for LogTinyLLMs. A l ∼ N (0, σ2 ). We apply this decomposition to each of the projection matrices: Q = H(Wl Q + α · BQAQ), K = H(Wl K + α · BKAK), V = H(Wl V + α · BV AV ). The proposed methodology is given in Algorithm 1 and the flowchart is given in [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗

**Figure 2.** Performance analysis of LoRA on Thunderbird dataset. These results indicate that adapter based models are more effective than LogBERT for log anomaly detection on the Thunderbird dataset, with the DeepSeek R1-DistillQwen-1.5B model achieving the best overall performance [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

18 extracted references · 10 canonical work pages

[1]

https://moldstud.com/articles/p-the-impact-of-big-data-on-software-development (2024)

Crudu, A.: The impact of big data on software development - MoldStud. https://moldstud.com/articles/p-the-impact-of-big-data-on-software-development (2024)

work page 2024
[2]

ICLR1(2), 3 (2022)

Hu, E.J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., Chen, W., et al.: Lora: Low-rank adaptation of large language models. ICLR1(2), 3 (2022)

2022
[3]

In: International Conference on Machine Learning, pp

Houlsby, N., Giurgiu, A., Jastrzebski, S., Morrone, B., De Laroussilhe, Q., Ges- mundo, A., Attariyan, M., Gelly, S.: Parameter-efficient transfer learning for NLP. In: International Conference on Machine Learning, pp. 2790–2799. PMLR (2019)

work page 2019
[4]

arXiv preprint arXiv:2401.02385 (2024)

Zhang, P., Zeng, G., Wang, T., Lu, W.: Tinyllama: An open-source small language model. arXiv preprint arXiv:2401.02385 (2024)

arXiv 2024
[5]

arXiv preprint arXiv:2308.03303 (2023)

Zhang, L., Zhang, L., Shi, S., Chu, X., Li, B.: Lora-fa: Memory-efficient low-rank adaptation for large language models fine-tuning. arXiv preprint arXiv:2308.03303 (2023)

arXiv 2023
[6]

Han, Xiao and Yuan, Shuhan and Trabelsi, Mohamed Loggpt: Log anomaly detec- tion via gpt.2023 IEEE International Conference on Big Data (BigData)(2023)

work page 2023
[7]

IEEE international conference on web services (ICWS) (2017)

He, Pinjia and Zhu, Jieming and Zheng, Zibin and Lyu, Michael R:Drain: An online log parsing approach with fixed depth tree. IEEE international conference on web services (ICWS) (2017)

work page 2017
[8]

Advances in Neural Information Pro- cessing Systems 30 (2017)

Vaswani,A.,Shazeer,N.,Parmar,N.,Uszkoreit,J.,Jones,L.,Gomez,A.N.,Kaiser, Ł., Polosukhin, I.: Attention is all you need. Advances in Neural Information Pro- cessing Systems 30 (2017)

work page 2017

Show all 18 references

[9]

In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp

Du, M., Li, F., Zheng, G., Srikumar, V.: Deeplog: Anomaly detection and diagnosis from system logs through deep learning. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 1285–1298 (2017)

2017
[10]

Advances in Neural Information Processing Systems (2017)

Vaswani, A.: Attention is all you need. Advances in Neural Information Processing Systems (2017)

2017
[12]

Guo, Daya and Yang, Dejian and Zhang, Haowei and Song, Junxiao and Zhang, Ruoyu and Xu, Runxin and Zhu, Qihao and Ma, Shirong and Wang, Peiyi and Bi, Xiao and others:Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning.arXiv preprint arXiv:2501.12...

2025 arXiv
[13]

Schmidt, Robin M:A gentle introduction and overview.arXiv preprint arXiv:1912.05911(1912)

1912 arXiv
[14]

In: 2021 International Joint Conference on Neural Networks (IJCNN), pp

Guo, H., Yuan, S., Wu, X.: Logbert: Log anomaly detection via bert. In: 2021 International Joint Conference on Neural Networks (IJCNN), pp. 1–8. IEEE (2021)

2021
[15]

The Naked Scientists Forum User: How does ChatGPT work? https://www.thenakedscientists.com/forum/index.php?topic=86257.0 (2024)

2024
[16]

In: 2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE), pp

Zhu, J., He, S., He, P., Liu, J., Lyu, M.R.: Loghub: A large collection of system log datasets for ai-driven log analytics. In: 2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE), pp. 355–366. IEEE (2023)

2023
[17]

In: 37th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN’07), pp

Oliner, A., Stearley, J.: What supercomputers say: A study of five system logs. In: 37th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN’07), pp. 575–584. IEEE (2007)

2007
[18]

arXiv preprint arXiv:2309.05463 (2023)

Li, Y., Bubeck, S., Eldan, R., Del Giorno, A., Gunasekar, S., Lee, Y.T.: Textbooks are all you need ii: phi-1.5 technical report. arXiv preprint arXiv:2309.05463 (2023)

2023 arXiv
[19]

arXiv preprint arXiv:2205.01068 (2022)

Zhang, S., Roller, S., Goyal, N., Artetxe, M., Chen, M., Chen, S., Dewan, C., Diab, M., Li, X., Lin, X.V., et al.: Opt: Open pre-trained transformer language models. arXiv preprint arXiv:2205.01068 (2022)

2022 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

https://moldstud.com/articles/p-the-impact-of-big-data-on-software-development (2024)

Crudu, A.: The impact of big data on software development - MoldStud. https://moldstud.com/articles/p-the-impact-of-big-data-on-software-development (2024)

work page 2024

[2] [2]

ICLR1(2), 3 (2022)

Hu, E.J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., Chen, W., et al.: Lora: Low-rank adaptation of large language models. ICLR1(2), 3 (2022)

2022

[3] [3]

In: International Conference on Machine Learning, pp

Houlsby, N., Giurgiu, A., Jastrzebski, S., Morrone, B., De Laroussilhe, Q., Ges- mundo, A., Attariyan, M., Gelly, S.: Parameter-efficient transfer learning for NLP. In: International Conference on Machine Learning, pp. 2790–2799. PMLR (2019)

work page 2019

[4] [4]

arXiv preprint arXiv:2401.02385 (2024)

Zhang, P., Zeng, G., Wang, T., Lu, W.: Tinyllama: An open-source small language model. arXiv preprint arXiv:2401.02385 (2024)

arXiv 2024

[5] [5]

arXiv preprint arXiv:2308.03303 (2023)

Zhang, L., Zhang, L., Shi, S., Chu, X., Li, B.: Lora-fa: Memory-efficient low-rank adaptation for large language models fine-tuning. arXiv preprint arXiv:2308.03303 (2023)

arXiv 2023

[6] [6]

Han, Xiao and Yuan, Shuhan and Trabelsi, Mohamed Loggpt: Log anomaly detec- tion via gpt.2023 IEEE International Conference on Big Data (BigData)(2023)

work page 2023

[7] [7]

IEEE international conference on web services (ICWS) (2017)

He, Pinjia and Zhu, Jieming and Zheng, Zibin and Lyu, Michael R:Drain: An online log parsing approach with fixed depth tree. IEEE international conference on web services (ICWS) (2017)

work page 2017

[8] [8]

Advances in Neural Information Pro- cessing Systems 30 (2017)

Vaswani,A.,Shazeer,N.,Parmar,N.,Uszkoreit,J.,Jones,L.,Gomez,A.N.,Kaiser, Ł., Polosukhin, I.: Attention is all you need. Advances in Neural Information Pro- cessing Systems 30 (2017)

work page 2017