pith. machine review for the scientific record. sign in

arxiv: 2605.09222 · v1 · submitted 2026-05-09 · 💻 cs.DB · cs.AI· cs.SE

Recognition: 1 theorem link

· Lean Theorem

Detect, Localize, and Explain: Interactive Hierarchical Log Anomaly Analytics with LLM Augmentation

Athanasios Tassiadamis, Dennis M. Hofmann, Elke Rundensteiner, Ethan Shanbaum, Haowen Xu, Lei Ma, Peter M. VanNostrand, Suhani Chaudhary

Authors on Pith no claims yet

Pith reviewed 2026-05-12 02:47 UTC · model grok-4.3

classification 💻 cs.DB cs.AIcs.SE
keywords log anomaly detectionhierarchical log abstractionLLM augmentationanomaly localizationinteractive visualizationmodular detectionsystem logs analysishuman-in-the-loop
0
0 comments X

The pith

Krone converts flat log sequences into three-level hierarchical units to support modular anomaly detection, localization, and selective LLM explanations.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Modern computing systems produce large volumes of unstructured logs that are difficult to analyze for anomalies when kept as flat sequences. Krone addresses this by defining a hierarchical abstraction that organizes logs into coherent units at the entity, action, and status levels. A supporting orchestration framework then breaks sequences into these units and runs detection tasks modularly across levels. This structure allows the system to identify anomalies more precisely, localize them to specific segments, and generate explanations by calling on LLM reasoning only when needed. An interactive visualization layer called Krone-viz makes the results usable for engineers, with features for reviewing and revising LLM outputs.

Core claim

Krone introduces a novel hierarchical log abstraction that transforms flat log sequences into semantically coherent units across entity, action, and status levels. Building on this abstraction, Krone introduces a hierarchical orchestration framework that decomposes flat log sequences into hierarchical execution units and performs modular detection over them. It executes and optimizes the modular detection tasks across levels, enabling precise anomaly detection, localization, and explanation with selective invocation of LLM-based reasoning.

What carries the argument

The three-level hierarchical log abstraction (entity, action, status) paired with the orchestration framework that decomposes sequences and runs modular detection across levels.

If this is right

  • Anomaly localization becomes more precise because abnormal segments can be identified at the level where they first appear rather than across an entire sequence.
  • LLM usage stays selective, invoking reasoning only for ambiguous or high-stakes cases and thereby controlling cost and latency.
  • Human operators can inspect the decomposition, review LLM explanations, and revise generated knowledge through the visualization interface.
  • Detection tasks can be optimized and executed independently at each level, improving scalability on large log volumes.
  • The approach yields actionable insights on the HDFS benchmark by surfacing both the location and the LLM-supported rationale for each flagged anomaly.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same hierarchical decomposition could be tested on other unstructured event streams such as traces or metrics to see whether modularity transfers beyond logs.
  • Adding automated checks for consistency between levels might reduce reliance on human guardrails while preserving the selective-LLM benefit.
  • If the entity-action-status split proves stable across domains, it could serve as a reusable intermediate representation for combining log analysis with root-cause tools.
  • The interactive revision loop in Krone-viz suggests a broader pattern for human-AI collaboration in monitoring systems where explanations must remain auditable.

Load-bearing premise

The three-level decomposition into entity, action, and status units produces coherent pieces that support accurate modular detection without losing critical information or dependencies from the original flat log sequences.

What would settle it

Running Krone on a log dataset containing anomalies whose detection requires cross-level dependencies that the three-level split would break, then checking whether the modular detector misses those anomalies while a flat-sequence baseline catches them.

Figures

Figures reproduced from arXiv: 2605.09222 by Athanasios Tassiadamis, Dennis M. Hofmann, Elke Rundensteiner, Ethan Shanbaum, Haowen Xu, Lei Ma, Peter M. VanNostrand, Suhani Chaudhary.

Figure 1
Figure 1. Figure 1: Flat log versus hierarchical log anomaly detection ( [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Krone framework overview. and LLM resource-efficiency (1.1%–3.3% of the test data size). We refer to Krone [4] for indepth evaluation study. Krone-viz Demonstration. Krone integrates anomaly detection, localization, and explanation with efficient LLM usage, reducing manual log analysis effort. To showcase its capabilities, we present Krone-viz, an interactive platform on the real-world HDFS log dataset. Kr… view at source ↗
Figure 3
Figure 3. Figure 3: Krone Log Abstraction Model a) The entity, action, and status of a log template, b) The Krone-Tree which encodes the semantic hierarchy from all log templates, c) An example log sequence of templates, and d) The Krone Seqs decomposed from the log sequence via Krone-Tree, in the form of "<parent>→ <node sequence>". Figure is adapted from the full paper [4]. the hierarchy-defined scope enables context-based … view at source ↗
Figure 4
Figure 4. Figure 4: Krone-viz Interactive Platform. knowledge base interface ( [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗
read the original abstract

Logs are ubiquitous in modern systems. Unfortunately, their unstructured nature in flat sequences limits understanding of execution behaviors, hindering effective anomaly diagnosis. To address this, Krone introduces a novel hierarchical log abstraction that transforms flat log sequences into semantically coherent units across entity, action, and status levels. Building on this abstraction, Krone introduces a hierarchical orchestration framework that decomposes flat log sequences into hierarchical execution units and performs modular detection over them. It executes and optimizes the modular detection tasks across levels, enabling precise anomaly detection, localization, and explanation with selective invocation of LLM-based reasoning. In this work, we present Krone-viz, an interactive visualization system based on Krone, which makes hierarchical log analysis interpretable and actionable for software engineers and system operators. Demonstrated on the widely used HDFS benchmark dataset, Krone-viz supports: 1) examining hierarchical decompositions of flat log sequences, 2) inspecting detection results and abnormal segments identified by Krone with LLM-generated explanations, and 3) reusing, reviewing, and revising knowledge generated by LLMs with human-in-the-loop guardrails. The code of Krone-viz is available at https://github.com/LeiMa0324/KRONE_Demo_official, and we deploy a live demo at https://leima0324.github.io/KRONE_Demo_official.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 2 minor

Summary. The paper claims to introduce Krone, a novel hierarchical log abstraction that converts flat log sequences into semantically coherent units at entity, action, and status levels. It proposes a hierarchical orchestration framework that decomposes logs into these units for modular anomaly detection, localization, and explanation, selectively using LLM-based reasoning. The work also presents Krone-viz, an interactive visualization system that allows users to examine decompositions, inspect results with LLM explanations, and revise LLM-generated knowledge via human-in-the-loop guardrails. The system is demonstrated on the HDFS dataset with code and demo available.

Significance. If the proposed hierarchy maintains critical dependencies and the modular approach proves effective, this could represent a significant advancement in log anomaly analytics by providing more structured and explainable detection in complex systems. The interactive visualization with LLM augmentation and guardrails offers practical value for software engineers and operators. The open availability of the code and live demo facilitates reproducibility and further research in the field.

major comments (2)
  1. [Hierarchical Orchestration Framework] The central claim relies on the entity-action-status hierarchy producing coherent units for modular detection. However, the framework description does not detail how cross-entity or cross-action dependencies are reconciled across levels, which could lead to missed anomalies in cases like resource contention or cascading failures.
  2. [Evaluation on HDFS] No quantitative metrics, comparisons to baselines, or ablation results are reported for the detection performance, undermining the ability to verify the claimed precision and effectiveness of the approach.
minor comments (2)
  1. [Abstract] Consider adding a sentence on the empirical outcomes from the HDFS demonstration to provide readers with immediate evidence of the system's utility.
  2. Ensure all figures in Krone-viz are clearly labeled and that the human-in-the-loop process is illustrated with an example workflow.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for their constructive feedback on our manuscript. We address each major comment point by point below, indicating where revisions will be made to strengthen the presentation of the hierarchical orchestration framework and the evaluation.

read point-by-point responses

  1. Referee: [Hierarchical Orchestration Framework] The central claim relies on the entity-action-status hierarchy producing coherent units for modular detection. However, the framework description does not detail how cross-entity or cross-action dependencies are reconciled across levels, which could lead to missed anomalies in cases like resource contention or cascading failures.

    Authors: We agree that additional detail on cross-level dependency handling would improve clarity. The orchestration framework processes units level-by-level while propagating contextual information from parent entities and actions to child status units, allowing modular detectors to consider interdependencies. In the revised manuscript we will add an explicit subsection describing the reconciliation mechanisms, with concrete examples of resource contention and cascading failures, and how selective LLM reasoning is invoked to resolve ambiguities across levels. revision: yes

  2. Referee: [Evaluation on HDFS] No quantitative metrics, comparisons to baselines, or ablation results are reported for the detection performance, undermining the ability to verify the claimed precision and effectiveness of the approach.

    Authors: We acknowledge that the current manuscript centers on the design of the Krone abstraction, orchestration framework, and Krone-viz system, presenting a demonstration on HDFS rather than a full quantitative benchmark. To address the concern, we will add a dedicated evaluation section that reports precision, recall, and F1 metrics on HDFS, includes comparisons to established log anomaly detection baselines, and presents ablation studies on the hierarchical components. These additions will be supported by the publicly available code. revision: yes

Circularity Check

0 steps flagged

No circularity: system presentation grounded in external code and demo

full rationale

The paper describes a hierarchical log abstraction and orchestration framework for anomaly detection, localization, and explanation, with LLM augmentation and an interactive visualization tool. No equations, fitted parameters, derivations, or load-bearing self-citations appear in the provided text. The central claims rest on the released code, live demo, and HDFS demonstration rather than any self-referential reduction of outputs to inputs. This is a standard system paper whose novelty is in the design and implementation, not in a closed mathematical chain.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 0 invented entities

The central claims rest on the domain assumption that logs contain recoverable hierarchical execution structure at entity-action-status levels and that selective LLM calls can produce trustworthy explanations when guided by the hierarchy. No free parameters or invented entities are introduced in the abstract.

axioms (1)
  • domain assumption Flat log sequences can be reliably decomposed into semantically coherent hierarchical units at entity, action, and status levels without loss of diagnostic information.
    Invoked in the description of the novel hierarchical log abstraction and the orchestration framework.

pith-pipeline@v0.9.0 · 5572 in / 1305 out tokens · 60542 ms · 2026-05-12T02:47:28.982808+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Lean theorems connected to this paper

Citations machine-checked in the Pith Canon. Every link opens the source theorem in the public Lean library.

Reference graph

Works this paper leans on

57 extracted references · 57 canonical work pages

  1. [1]

    2026 , howpublished=

    KRONE: Hierarchical and Modular Log Anomaly Detection , author=. 2026 , howpublished=

    work page 2026

  2. [2]

    Bridging the Gap: LLM-Powered Transfer Learning for Log Anomaly Detection in New Software Systems , year=

    Sui, Yicheng and Wang, Xiaotian and Cui, Tianyu and Xiao, Tong and He, Chenghao and Zhang, Shenglin and Zhang, Yuzhi and Yang, Xiao and Sun, Yongqian and Pei, Dan , booktitle=. Bridging the Gap: LLM-Powered Transfer Learning for Log Anomaly Detection in New Software Systems , year=

    work page

  3. [3]

    2023 , isbn =

    Egersdoerfer, Chris and Zhang, Di and Dai, Dong , title =. 2023 , isbn =. doi:10.1145/3588195.3595943 , booktitle =

    work page doi:10.1145/3588195.3595943 2023

  4. [4]

    2025 , eprint=

    LLM-based event log analysis techniques: A survey , author=. 2025 , eprint=

    work page 2025

  5. [5]

    2025 , url=

    Lingzhe Zhang and Tong Jia and Mengxi Jia and Yifan Wu and Hongyi Liu and Ying Li , booktitle=. 2025 , url=

    work page 2025

  6. [6]

    2024 , eprint=

    Large Language Models for Forecasting and Anomaly Detection: A Systematic Literature Review , author=. 2024 , eprint=

    work page 2024

  7. [7]

    LLMParser: An Exploratory Study on Using Large Language Models for Log Parsing , url=

    Ma, Zeyang and Chen, An Ran and Kim, Dong Jae and Chen, Tse-Hsun and Wang, Shaowei , year=. LLMParser: An Exploratory Study on Using Large Language Models for Log Parsing , url=. doi:10.1145/3597503.3639150 , booktitle=

    work page doi:10.1145/3597503.3639150

  8. [8]

    2024 , eprint=

    LibreLog: Accurate and Efficient Unsupervised Log Parsing Using Open-Source Large Language Models , author=. 2024 , eprint=

    work page 2024

  9. [9]

    2024 , eprint=

    HELP: Hierarchical Embeddings-based Log Parsing , author=. 2024 , eprint=

    work page 2024

  10. [10]

    AIOps for log anomaly detection in the era of LLMs: A systematic literature review , journal =

    Miguel. AIOps for log anomaly detection in the era of LLMs: A systematic literature review , journal =. 2025 , issn =. doi:https://doi.org/10.1016/j.iswa.2025.200608 , url =

    work page doi:10.1016/j.iswa.2025.200608 2025

  11. [11]

    2023 , eprint=

    RAGLog: Log Anomaly Detection using Retrieval Augmented Generation , author=. 2023 , eprint=

    work page 2023

  12. [12]

    Self-Attentive Classification-Based Anomaly Detection in Unstructured Logs , year=

    Nedelkoski, Sasho and Bogatinovski, Jasmin and Acker, Alexander and Cardoso, Jorge and Kao, Odej , booktitle=. Self-Attentive Classification-Based Anomaly Detection in Unstructured Logs , year=

    work page

  13. [13]

    Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security , pages =

    Du, Min and Li, Feifei and Zheng, Guineng and Srikumar, Vivek , title =. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security , pages =. 2017 , isbn =. doi:10.1145/3133956.3134015 , abstract =

    work page doi:10.1145/3133956.3134015 2017

  14. [14]

    Proceedings of the 27th ACM SIGKDD conference on knowledge discovery & data mining , pages=

    Multi-scale one-class recurrent neural networks for discrete event sequence anomaly detection , author=. Proceedings of the 27th ACM SIGKDD conference on knowledge discovery & data mining , pages=

    work page

  15. [15]

    Proceedings of the ACM on Management of Data , volume=

    Robust and Transferable Log-based Anomaly Detection , author=. Proceedings of the ACM on Management of Data , volume=. 2023 , publisher=

    work page 2023

  16. [16]

    2021 international joint conference on neural networks (IJCNN) , pages=

    Logbert: Log anomaly detection via bert , author=. 2021 international joint conference on neural networks (IJCNN) , pages=. 2021 , organization=

    work page 2021

  17. [17]

    , author=

    LogAnomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs. , author=. IJCAI , volume=

    work page

  18. [18]

    Black Box Fairness Testing of Machine Learning Models , booktitle =

    Zhang, Xu and Xu, Yong and Lin, Qingwei and Qiao, Bo and Zhang, Hongyu and Dang, Yingnong and Xie, Chunyu and Yang, Xinsheng and Cheng, Qian and Li, Ze and Chen, Junjie and He, Xiaoting and Yao, Randolph and Lou, Jian-Guang and Chintalapati, Murali and Shen, Furao and Zhang, Dongmei , title =. 2019 , isbn =. doi:10.1145/3338906.3338931 , booktitle =

    work page doi:10.1145/3338906.3338931 2019

  19. [19]

    Proceedings of the 38th International Conference on Software Engineering Companion , pages=

    Log clustering based problem identification for online service systems , author=. Proceedings of the 38th International Conference on Software Engineering Companion , pages=

    work page

  20. [20]

    2022 , isbn =

    Zhang, Shengming and Liu, Yanchi and Zhang, Xuchao and Cheng, Wei and Chen, Haifeng and Xiong, Hui , title =. 2022 , isbn =. doi:10.1145/3534678.3539155 , booktitle =

    work page doi:10.1145/3534678.3539155 2022

  21. [21]

    and Hofmann, Dennis M

    Ma, Lei and Cao, Lei and VanNostrand, Peter M. and Hofmann, Dennis M. and Su, Yao and Rundensteiner, Elke A. , title =. 2024 , issue_date =. doi:10.1145/3677139 , journal =

    work page doi:10.1145/3677139 2024

  22. [22]

    Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , pages=

    Augmenting log-based anomaly detection models to reduce false anomalies with human feedback , author=. Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining , pages=

    work page

  23. [23]

    2023 , eprint=

    LogGPT: Log Anomaly Detection via GPT , author=. 2023 , eprint=

    work page 2023

  24. [24]

    2024 , eprint=

    Interpretable Online Log Analysis Using Large Language Models with Prompt Strategies , author=. 2024 , eprint=

    work page 2024

  25. [25]

    A comprehensive study of machine learning techniques for log-based anomaly detection , volume=

    Ali, Shan and Boufaied, Chaima and Bianculli, Domenico and Branco, Paula and Briand, Lionel , year=. A comprehensive study of machine learning techniques for log-based anomaly detection , volume=. Empirical Software Engineering , publisher=. doi:10.1007/s10664-025-10669-3 , number=

    work page doi:10.1007/s10664-025-10669-3

  26. [26]

    Communications of the ACM , volume=

    Advances and challenges in log analysis , author=. Communications of the ACM , volume=. 2012 , publisher=

    work page 2012

  27. [27]

    LogFlash: Real-time Streaming Anomaly Detection and Diagnosis from System Logs for Large-scale Software Systems , year=

    Jia, Tong and Wu, Yifan and Hou, Chuanjia and Li, Ying , booktitle=. LogFlash: Real-time Streaming Anomaly Detection and Diagnosis from System Logs for Large-scale Software Systems , year=

    work page

  28. [28]

    LogSed: Anomaly Diagnosis through Mining Time-Weighted Control Flow Graph in Logs , year=

    Jia, Tong and Yang, Lin and Chen, Pengfei and Li, Ying and Meng, Fanjing and Xu, Jingmin , booktitle=. LogSed: Anomaly Diagnosis through Mining Time-Weighted Control Flow Graph in Logs , year=

    work page

  29. [29]

    IEEE transactions on knowledge and data engineering , volume=

    Anomaly detection for discrete sequences: A survey , author=. IEEE transactions on knowledge and data engineering , volume=. 2010 , publisher=

    work page 2010

  30. [30]

    Machine Learning with Applications , volume=

    Deep learning for anomaly detection in log data: A survey , author=. Machine Learning with Applications , volume=. 2023 , publisher=

    work page 2023

  31. [31]

    A Survey on Log Anomaly Detection using Deep Learning , year=

    Yadav, Rakesh Bahadur and Kumar, P Santosh and Dhavale, Sunita Vikrant , booktitle=. A Survey on Log Anomaly Detection using Deep Learning , year=

    work page

  32. [32]

    Proceedings of the 44th International Conference on Software Engineering , pages=

    Log-based anomaly detection with deep learning: How far are we? , author=. Proceedings of the 44th International Conference on Software Engineering , pages=

    work page

  33. [33]

    2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE) , pages=

    Log-based anomaly detection without log parsing , author=. 2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE) , pages=. 2021 , organization=

    work page 2021

  34. [34]

    2016 IEEE 27th international symposium on software reliability engineering (ISSRE) , pages=

    Experience report: System log analysis for anomaly detection , author=. 2016 IEEE 27th international symposium on software reliability engineering (ISSRE) , pages=. 2016 , organization=

    work page 2016

  35. [35]

    2019 , eprint=

    Tools and Benchmarks for Automated Log Parsing , author=. 2019 , eprint=

    work page 2019

  36. [36]

    2017 IEEE international conference on web services (ICWS) , pages=

    Drain: An online log parsing approach with fixed depth tree , author=. 2017 IEEE international conference on web services (ICWS) , pages=. 2017 , organization=

    work page 2017

  37. [37]

    2016 IEEE 16th International Conference on Data Mining (ICDM) , pages=

    Spell: Streaming parsing of system event logs , author=. 2016 IEEE 16th International Conference on Data Mining (ICDM) , pages=. 2016 , organization=

    work page 2016

  38. [38]

    Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles , pages=

    Detecting large-scale system problems by mining console logs , author=. Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles , pages=

    work page

  39. [39]

    37th annual IEEE/IFIP international conference on dependable systems and networks (DSN'07) , pages=

    What supercomputers say: A study of five system logs , author=. 37th annual IEEE/IFIP international conference on dependable systems and networks (DSN'07) , pages=. 2007 , organization=

    work page 2007

  40. [40]

    Proceedings of the IEEE , volume=

    A unifying review of deep and shallow anomaly detection , author=. Proceedings of the IEEE , volume=. 2021 , publisher=

    work page 2021

  41. [41]

    ACM computing surveys (CSUR) , volume=

    Anomaly detection: A survey , author=. ACM computing surveys (CSUR) , volume=. 2009 , publisher=

    work page 2009

  42. [42]

    and Borghetti, Brett J

    Weller-Fahy, David J. and Borghetti, Brett J. and Sodemann, Angela A. , journal=. A Survey of Distance and Similarity Measures Used Within Network Intrusion Anomaly Detection , year=

    work page

  43. [43]

    2022 , isbn =

    Li, Sainan and Yin, Qilei and Li, Guoliang and Li, Qi and Liu, Zhuotao and Zhu, Jinwei , title =. 2022 , isbn =. doi:10.1145/3514221.3517861 , booktitle =

    work page doi:10.1145/3514221.3517861 2022

  44. [44]

    Advances in Neural Information Processing Systems , volume=

    Adbench: Anomaly detection benchmark , author=. Advances in Neural Information Processing Systems , volume=

    work page

  45. [45]

    and Pinto, H

    Jian Pei and Jiawei Han and Mortazavi-Asl, B. and Pinto, H. and Qiming Chen and Dayal, U. and Mei-Chun Hsu , booktitle=. PrefixSpan,: mining sequential patterns efficiently by prefix-projected pattern growth , year=

    work page

  46. [46]

    2007 , issue_date =

    Han, Jiawei and Cheng, Hong and Xin, Dong and Yan, Xifeng , title =. 2007 , issue_date =. doi:10.1007/s10618-006-0059-1 , journal =

    work page doi:10.1007/s10618-006-0059-1 2007

  47. [47]

    Machine learning , volume=

    SPADE: An efficient algorithm for mining frequent sequences , author=. Machine learning , volume=. 2001 , publisher=

    work page 2001

  48. [48]

    The source code of Loglizer , howpublished =

    work page

  49. [49]

    The source code of Deep-Loglizer , howpublished =

    work page

  50. [50]

    The source code of OC4Seq , howpublished =

    work page

  51. [51]

    The source code of LogBERT , howpublished =

    work page

  52. [52]

    The source code of LogPrompt , howpublished =

    work page

  53. [53]

    Log-based Anomaly Detection Without Log Parsing , year=

    Le, Van-Hoang and Zhang, Hongyu , booktitle=. Log-based Anomaly Detection Without Log Parsing , year=

    work page

  54. [54]

    and Atkins, E

    Hansen, Stephen E. and Atkins, E. Todd , title =. Proceedings of the 7th USENIX Conference on System Administration , pages =. 1993 , publisher =

    work page 1993

  55. [55]

    , title =

    Rouillard, John P. , title =. Proceedings of the 18th USENIX Conference on System Administration , pages =. 2004 , publisher =

    work page 2004

  56. [56]

    , booktitle=

    He, Pinjia and Zhu, Jieming and He, Shilin and Li, Jian and Lyu, Michael R. , booktitle=. An Evaluation Study on Log Parsing and Its Use in Log Mining , year=

    work page

  57. [57]

    2022 , issue_date =

    Fu, Ying and Yan, Meng and Xu, Zhou and Xia, Xin and Zhang, Xiaohong and Yang, Dan , title =. 2022 , issue_date =. doi:10.1007/s10664-022-10214-6 , journal =

    work page doi:10.1007/s10664-022-10214-6 2022