CLAD: Efficient Log Anomaly Detection Directly on Compressed Representations Benzhao Tang, Shiyu Yang Guangzhou University; [email protected]; [email protected];
arXiv:2604.13024v1 [cs.LG] 14 Apr 2026
ABSTRACT The explosive growth of system logs makes streaming compression essential, yet existing log anomaly detection (LAD) methods incur severe pre-processing overhead by requiring full decompression and parsing. We introduce CLAD, the first deep learning framework to perform LAD directly on compressed byte streams. CLAD bypasses these bottlenecks by exploiting a key insight: normal logs compress into regular byte patterns, while anomalies systematically disrupt them. To extract these multi-scale deviations from opaque bytes, we propose a purpose-built architecture integrating a dilated convolutional byte encoder, a hybrid Transformer–mLSTM, and four-way aggregation pooling. This is coupled with a two-stage training strategy of masked pre-training and focal-contrastive finetuning to effectively handle severe class imbalance. Evaluated across five datasets, CLAD achieves a state-of-the-art average F1-score of 0.9909 and outperforms the best baseline by 2.72 percentage points. It delivers superior accuracy while completely eliminating decompression and parsing overheads, offering a robust solution that generalizes to structured streaming compressors. PVLDB Reference Format: Benzhao Tang, Shiyu Yang. CLAD: Efficient Log Anomaly Detection Directly on Compressed Representations. PVLDB, 18(11): XXX-XXX, 2025. doi:XX.XX/XXX.XX PVLDB Artifact Availability: The source code, data, and/or other artifacts have been made available at https://github.com/benzhaotang/XXXXX.
1
INTRODUCTION
System logs are indispensable for monitoring, diagnosing, and safeguarding modern software infrastructure. Every layer of a distributed system—from application servers and container orchestrators to storage engines and network devices—continuously emits log entries that capture state transitions, error conditions, and security-relevant events. Driven by the proliferation of microservice architectures and IoT deployments, the daily volume of log generation has surged to tens of petabytes: Uber produces over 10 PB during peak periods [28], and WeChat generates 16–20 PB daily [37]. Given regulatory mandates requiring lossless retention ∗ Shiyu Yang is the corresponding author. This work is licensed under the Creative Commons BY-NC-ND 4.0 International License. Visit https://creativecommons.org/licenses/by-nc-nd/4.0/ to view a copy of this license. For any use beyond those covered by this license, obtain permission by emailing [email protected]. Copyright is held by the owner/author(s). Publication rights licensed to the VLDB Endowment. Proceedings of the VLDB Endowment, Vol. 18, No. 11 ISSN 2150-8097. doi:XX.XX/XXX.XX
for months to years [13, 21, 30, 31], the cost of collecting, transmitting, and archiving log data has become a first-order operational concern. Streaming log compressors such as LogLite [24] have emerged as an effective response. Operating line-by-line at the point of generation, these compressors produce compact byte streams that can be transmitted to cloud servers immediately, reducing bandwidth and storage costs by an order of magnitude without sacrificing log fidelity. Meanwhile, log anomaly detection (LAD) remains a critical online analysis task: operators need to identify anomalous system behaviors—hardware faults, service degradation, security incidents—from the incoming log stream with minimal latency. However, existing LAD methods impose a fundamental conflict with the compressed data path. Whether they rely on parsed log templates [3, 33, 41] or operate directly on raw log text [6, 10], all prior approaches require access to fully decompressed log messages. This forces a decompress–parse–extract–detect pipeline that partially negates the efficiency gains achieved on the data path. The decompression and parsing stages alone consume a significant portion of the end-to-end detection time, constituting a throughput bottleneck in high-volume streaming environments. A natural question arises: is decompression truly necessary for anomaly detection? Streaming compressors exploit the regularity of normal log data—fixed templates, limited variable ranges, and temporal locality—to achieve high compression ratios. Anomalous entries, which by definition deviate from these regularities, produce compressed representations that systematically differ from normal ones: novel keywords generate longer literal runs, unexpected variable values disrupt run-length patterns, and new templates yield entirely uncompressed output. These structured deviations suggest that the compressed byte stream itself carries sufficient signal for anomaly detection—without the need for decompression or parsing. Building on this insight, we propose CLAD (Compressed Log Anomaly Detection), the first deep learning framework that performs anomaly detection directly on compressed log byte streams. CLAD takes the variable-length byte sequence emitted by a streaming compressor for a window of consecutive log entries, and outputs a binary anomaly prediction—bypassing the entire text-level processing pipeline. Its architecture is purpose-built for the multi-scale structural regularity of compressor output, combining a dilated convolutional encoder, a hybrid Transformer–mLSTM sequential encoder, and a four-way aggregation pooling mechanism. A twostage training strategy—self-supervised pre-training via masked feature prediction followed by joint focal-contrastive fine-tuning— addresses the unique challenges of learning from semantically opaque bytes under severe class imbalance. Although our primary
evaluation uses LogLite-B as the streaming compressor, the architecture generalizes to any compressor whose output exhibits structured byte-level patterns—a property shared by the broad family of LZ-, RLE-, and dictionary-based compressors. Compressed-domain computing has been explored in database query processing [5, 39, 42] and log retrieval [21, 28, 30], but these systems are restricted to deterministic operations such as keyword matching and statistical aggregation. CLAD bridges the gap to deep analytical tasks, elevating compressed-domain computing from shallow retrieval to semantic-level anomaly detection. Contributions. • We establish, for the first time, a direct path from compressed log ingestion to anomaly prediction, entirely eliminating the decompression and parsing stages required by all prior LAD methods and reducing end-to-end latency in high-throughput streaming environments. • We propose CLAD, a five-stage neural architecture comprising a dilated convolutional byte encoder, a hybrid Transformer– mLSTM sequential encoder, and four-way aggregation pooling, purpose-built to capture the multi-scale structural patterns present in compressed byte streams. • We design a two-stage training strategy combining masked feature prediction with InfoNCE contrastive pre-training and joint focal-contrastive fine-tuning, together with contextual priority sampling and span masking augmentation, to address the challenges of learning from semantically opaque bytes under severe class imbalance. • On five widely used datasets, CLAD achieves the highest F1-score on every dataset (average 0.9909), outperforming the best baseline by 2.72 percentage points—despite operating on compressed byte streams that have never been decompressed or parsed.
2
CLAD MODEL ARCHITECTURE
This section details the architecture of CLAD, following the data flow through five stages: architectural overview (§2.1), byte embedding (§2.2), multi-scale dilated CNN encoder (§2.3), hybrid Transformer– mLSTM sequential encoder (§2.4), four-way aggregation pooling (§2.5), and the anomaly detection head (§2.6).
2.1
Architectural Overview
CLAD operates on the compressed byte sequence corresponding to a window of 𝑊 consecutive log entries (by default 𝑊 = 100). A streaming compressor processes the window and emits a variablelength byte sequence b = (𝑏 1, 𝑏 2, . . . , 𝑏 𝐿 ), where each element 𝑏𝑖 ∈ {0, 1, . . . , 255}. CLAD takes this byte sequence as input and produces a binary prediction indicating whether the window contains anomalous log entries. The end-to-end pipeline proceeds through five stages. (i) Byte Embedding. Each byte is mapped to a continuous vector via a learnable embedding table; a special classification token [CLS] is prepended to the sequence. (ii) Multi-Scale Dilated CNN Encoder. The embedded byte sequence (excluding [CLS]) is compressed by a stack of dilated convolutional blocks that reduce the sequence length by 16× while extracting local byte-level patterns at multiple scales.
(iii) Hybrid Transformer–mLSTM Sequential Encoder. The projected [CLS] embedding is concatenated with the CNN output, augmented with positional encodings, and processed by a two-layer encoder comprising one Transformer self-attention layer and one mLSTM memory layer. (iv) Four-Way Aggregation Pooling. The encoder output is aggregated through four complementary pooling mechanisms—CLS, learned attention, max, and mean—that capture different aspects of anomaly manifestation. (v) Anomaly Detection Head. A lightweight linear classifier with multi-scale dropout produces the final prediction. Formally, given compressed byte sequence b, CLAD computes: 𝑦ˆ = 𝑓head 𝑓pool 𝑓enc 𝑓cnn 𝑓emb (b) , (1) where 𝑦ˆ ∈ {0, 1} denotes the predicted anomaly label.
2.2
Byte Embedding Layer
The first stage converts discrete byte values into continuous representations amenable to neural network processing. We maintain a learnable embedding matrix E ∈ R𝑉 ×𝑑𝑒 , where the vocabulary size 𝑉 = 259 covers four disjoint tokens: the 256 standard byte values (IDs 0–255) representing all possible byte outputs of the compressor, a padding token [PAD] (ID 256) for batching sequences of variable length, a classification token [CLS] (ID 257) serving as a global sequence-level anchor, and a mask token [MASK] (ID 258) used exclusively during self-supervised pre-training (§3.1). The byte embedding dimension is set to 𝑑𝑒 = 128. The input sequence is constructed by prepending [CLS] to the raw compressed byte sequence. Sequences exceeding the maximum length 𝐿max = 8,192 are truncated; shorter sequences are rightpadded with [PAD]. A scalar field lengths records the number of valid (non-padding) positions in each sample and is propagated through all subsequent stages to ensure that padding tokens do not contribute to pooling or loss computation. Design rationale. Unlike natural language processing where each token carries explicit semantic meaning, individual bytes in a compressed stream are semantically opaque—their meaning depends on context (e.g., whether a given byte represents an RLE count, a preserved original character, or a header field). A learnable embedding allows the model to discover context-dependent byte representations during training. The moderate embedding dimension (𝑑𝑒 = 128, expanded to 𝑑 = 512 by the CNN) balances representational capacity against the risk of overfitting on the relatively small byte vocabulary.
2.3
Multi-Scale Dilated CNN Encoder
After embedding, the [CLS] token is separated and projected from 𝑑𝑒 to the model dimension 𝑑 = 512 through a linear layer. The remaining byte embeddings X ∈ R (𝐿max −1) ×𝑑𝑒 are transposed to channel-first layout and passed through a three-block convolutional encoder. 2.3.1 Multi-Scale Structure of Compressed Byte Streams. Anomalies disrupt compression patterns at multiple granularities. The compressed byte stream mirrors this multi-scale structure. At the finest granularity (2–5 bytes), individual structural elements are encoded: 1-byte headers, single-byte RLE counts, and individual
preserved characters. At a medium scale (10–30 bytes), complete compressed log entries emerge, each consisting of a header, an instruction bitmap, and a data payload. At the coarsest scale (50– 100+ bytes), patterns spanning multiple entries reflect the overall composition of the window—the distribution of compressed vs. uncompressed entries, the frequency of different Window_ID values, and the statistical profile of RLE run lengths. Anomalies manifest at all three scales: a novel error keyword produces an uncompressed entry with distinctive fine-grained byte patterns; a malformed entry with unexpected variables disrupts the medium-scale RLE structure; and a burst of anomalous entries alters the coarse-scale statistical profile. 2.3.2 Architecture. To capture these multi-scale patterns efficiently, the CNN encoder employs three convolutional blocks with increasing dilation rates, each consisting of a one-dimensional convolution, group normalization [32] (with a single group, equivalent to layer normalization along the channel dimension), and ReLU activation. Block 1 (fine-grained, dilation = 1). Conv1d with 256 output channels, kernel size 5, stride 2, and dilation 1. The receptive field spans 5 byte positions, covering individual header fields, RLE counts, and preserved characters—the atomic units of the compressed representation. Block 2 (medium-range, dilation = 2). Conv1d with 512 output channels, kernel size 5, stride 2, and dilation 2. The effective receptive field expands to approximately 18 original byte positions, sufficient to capture the complete structure of a single compressed log entry. Block 3 (coarse-scale, dilation = 4). Conv1d with 512 output channels, kernel size 5, stride 4, and dilation 4. The effective receptive field reaches approximately 68 original byte positions, spanning multiple compressed entries and enabling cross-entry pattern recognition. The cumulative stride of 2 × 2 × 4 = 16 reduces the sequence length from approximately 8,191 positions to 𝑇 ′ ≈ 512, transforming a raw byte sequence that would require 𝑂 (𝐿 2 ) self-attention computation into a manageable length. Concurrently, the increasing dilation rates (1, 2, 4) expand the receptive field to well over 100 positions without increasing the parameter count. This 16× compression is a critical enabler for the subsequent Transformer layer, whose quadratic attention cost on the original 8,192-length sequence would be prohibitive.
2.4
Hybrid Transformer–mLSTM Sequential Encoder
The projected [CLS] embedding is concatenated with the CNN output to form the encoder input: ′ H (0) = ccls ; s1, . . . , s𝑇 ′ ∈ R (1+𝑇 ) ×𝑑 ,
(2)
augmented with sinusoidal positional encodings [26]. The encoder is a stack of two heterogeneous layers: one Transformer self-attention layer followed by one mLSTM memory layer. 2.4.1 Transformer Self-Attention Layer. The Transformer layer adopts a Pre-Norm architecture [34] with RMSNorm [38] for stable
training and a SwiGLU [22] feed-forward network for improved expressivity. Multi-head self-attention uses 𝐻 = 8 heads with model dimension 𝑑 = 512, and the SwiGLU FFN has inner dimension 𝑑 ff = 2,048. The forward pass is: H′ = H + Dropout MHA RMSNorm(H) , (3) H (1) = H′ + SwiGLU RMSNorm(H′ ) . (4) The Transformer layer captures long-range pairwise interactions through full quadratic attention. In compressed log streams, certain anomalies are detectable only through cross-position reasoning— for example, relating a compressed error code in one entry to a compressed configuration value in a distant entry. The self-attention mechanism excels at modeling such dependencies, and the relatively short input length (𝑇 ′ ≈ 512 after CNN compression) makes the 𝑂 (𝑇 ′2 ) cost manageable. 2.4.2 mLSTM Memory Layer. The mLSTM layer [1] complements the Transformer with 𝑂 (𝑇 ′ ) linear-time processing through a matrix-valued associative memory. Before the attention computation, a depthwise separable convolution with kernel size 3 injects local context, which is important for resolving sub-token byte groupings that arise from multi-byte RLE counts and instructiondata boundaries in the compressed stream. The core mechanism uses squared ReLU kernels for query and key projections: 2 2 q̂𝑡 = ReLU(q𝑡 ) , k̂𝑡 = ReLU(k𝑡 ) , (5) and computes the output via a matrix memory: Í q̂⊤ C C = K̂⊤ V, z = 𝑡 k̂𝑡 , o𝑡 = q̂⊤𝑡z+𝜖 ,
(6)
𝑡
where C ∈ R𝑑ℎ ×𝑑ℎ accumulates a compressed summary of all key– value associations. The mLSTM layer uses the same Pre-Norm residual structure and SwiGLU FFN as the Transformer layer. 2.4.3 Rationale for the Hybrid Design. The two layers serve complementary roles. The Transformer’s full attention computes explicit pairwise relationships between all CNN output positions, essential for detecting anomalies that manifest as unusual correlations between specific byte patterns at distant positions. The mLSTM’s linear attention with matrix memory efficiently captures global distributional statistics—the overall distribution of byte values, the frequency of different RLE run lengths, and the proportion of compressed vs. uncompressed entries—which reflect the macro-level health of the log window. These statistics are naturally summarized by the additive key–value accumulation in Equation (6). By stacking one layer of each type rather than multiple layers of a single type, CLAD achieves an effective balance between representational power and computational efficiency, keeping the model lightweight enough for online deployment where the compressed stream must be analyzed in real time.
2.5
Four-Way Aggregation Pooling
Anomalies in compressed log streams manifest in fundamentally different ways: some produce sharp localized byte-pattern deviations, others cause diffuse distributional shifts across the entire window, and still others are detectable only through selective focus
on specific positions. A single pooling strategy inevitably introduces bias toward one manifestation type. We propose a four-way aggregation pooling mechanism that extracts complementary ′ views of the encoded sequence H ∈ R (1+𝑇 ) ×𝑑 . Path 1: CLS pooling. The [CLS] output hcls = H[0] provides a holistic summary. Having attended to all positions through both encoder layers, it integrates fine-grained pairwise interactions with global distributional statistics. Path 2: Learned attention pooling. A two-layer scoring network computes position-wise importance weights: exp w⊤ Í 2 tanh(W1 h𝑡 ) , a = 𝑡 𝛼𝑡 h𝑡 , 𝛼𝑡 = Í (7) ⊤ 𝑡 ′ exp w2 tanh(W1 h𝑡 ′ ) where W1 ∈ R (𝑑/4) ×𝑑 and w2 ∈ R𝑑/4 . This path learns to selectively focus on positions where anomalous byte patterns deviate from the expected compressed structure. Path 3: Max pooling. Element-wise maximum over valid positions captures the most salient activation per feature dimension, effective at detecting spike anomalies such as previously unseen error messages emitted as uncompressed literal content. Path 4: Mean pooling. Length-normalized average over valid positions captures the aggregate distributional profile, effective for detecting diffuse anomalies where no single entry is dramatically anomalous but the overall window deviates from the norm. The four representations are concatenated: p = [ hcls ; a; m; 𝝁 ] ∈ R4𝑑 .
2.6
(8)
Anomaly Detection Head with Multi-Scale Dropout
The detection head maps the 4𝑑-dimensional pooled vector to a binary anomaly prediction via a single linear layer: z = Wcls p + bcls,
Wcls ∈ R2×4𝑑 .
(9)
Multi-Scale Dropout. During training, instead of a single forward pass with one dropout mask, we perform 𝐾 = 5 independent forward passes through the linear layer, each with a different random dropout mask applied to p (dropout rate 𝑝 = 0.15), and average the resulting logits: ztrain =
𝐾 1 ∑︁ Wcls · Dropout𝑘 (p) + bcls . 𝐾
(10)
𝑘=1
This functions as an implicit ensemble at the feature level: each dropout mask forces the classifier to rely on a different subset of the 4𝑑 features from the four pooling paths, preventing coadaptation between pooling signals and producing more robust, better-calibrated predictions. The mechanism is particularly important for anomaly detection, where the cost of false negatives is typically high: ensemble averaging reduces logit variance, thereby reducing the likelihood that a borderline anomalous window is misclassified. During inference, dropout is disabled and a single forward pass is performed, incurring no additional cost.
3
TRAINING STRATEGY AND OPTIMIZATION
Training CLAD on compressed log byte streams presents unique challenges. First, individual bytes lack the discrete semantic grounding of word tokens, making standard masked language modeling
objectives ill-suited. Second, log anomaly detection datasets exhibit severe class imbalance, with anomalous windows often constituting less than 5% of the data. Third, anomalous events cluster temporally, creating a non-uniform distribution that standard random sampling ignores. We address these challenges with a two-stage pipeline: selfsupervised pre-training that learns general-purpose byte-level representations (§3.1), followed by fine-tuning with a joint focal-contrastive objective (§3.2). We additionally introduce contextual priority sampling (§3.2.2), span masking augmentation (§3.2.3), and a comprehensive optimization procedure (§3.2.4).
3.1
Self-Supervised Pre-Training via Masked Feature Prediction
The goal of pre-training is to learn byte-level representations that capture the structural regularities of compressed log streams, providing a strong initialization for supervised fine-tuning. 3.1.1 Why Not Masked Byte Modeling? A natural starting point is masked language modeling adapted to the byte level: mask random positions and predict the original byte value. This approach is poorly suited for compressed streams for two reasons. First, the 256-class prediction task is dominated by a few high-frequency values (e.g., the null byte 0x00 from RLE, common ASCII characters from XOR-Preserve), and cross-entropy loss provides weak gradients for rare but informative bytes. Second, predicting the exact byte value requires modeling low-level encoding details (e.g., precise RLE counts) that are largely irrelevant for anomaly detection; what matters is whether the pattern of a compressed region is normal, not its exact byte values. 3.1.2 Masked Feature Prediction. We instead design a masked feature prediction task operating in the continuous feature space of the CNN encoder. The input byte sequence is first embedded and passed through the CNN to obtain the downsampled feature ′ sequence S = (s1, . . . , s𝑇 ′ ) ∈ R𝑇 ×𝑑 . A proportion 𝑟 = 15% of valid positions are randomly selected and replaced with a learnable mask embedding emask ∈ R𝑑 . The masked sequence, together with the projected [CLS] token and positional encodings, is processed by the full hybrid encoder. A linear prediction head Wpred ∈ R𝑑 ×𝑑 maps each encoder output at a masked position back to the 𝑑-dimensional feature space. Masking at the CNN feature level rather than the raw byte level is deliberate. Each CNN output position aggregates information from a receptive field of dozens of bytes, capturing a local compressed pattern such as a complete RLE-encoded entry. Predicting this feature vector requires the model to understand the structural role of the masked region within the window—precisely the representation needed for downstream anomaly detection. 3.1.3 InfoNCE Contrastive Loss. A naïve MSE objective is vulnerable to representation collapse: the model can minimize loss by mapping all positions to a constant vector. This risk is acute for compressed streams, whose feature distribution is concentrated around common patterns. We adopt the InfoNCE loss [19]. Let P = {ŝ1, . . . , ŝ𝑁 } and T = {s1, . . . , s𝑁 } denote the 𝐿2 -normalized predicted and original feature vectors at the 𝑁 masked positions
within a mini-batch. The pre-training loss is: Lpre = −
𝑁 exp(ŝ𝑖⊤ s𝑖 /𝜏) 1 ∑︁ log Í𝑁 , ⊤ 𝑁 𝑖=1 𝑗=1 exp(ŝ𝑖 s 𝑗 /𝜏)
(11)
with temperature 𝜏 = 0.1. If the model collapses to constant output, numerator and denominator terms become identical and the loss degrades to log 𝑁 —the theoretical maximum—generating a strong corrective gradient. The contrastive objective simultaneously encourages discriminative features that distinguish different compressed patterns, directly benefiting the downstream separation of normal and anomalous representations.
3.2
Fine-Tuning with Joint Focal-Contrastive Learning
After pre-training, the entire model is fine-tuned end-to-end on labeled compressed log windows. 3.2.1 Joint Loss Function. The fine-tuning objective combines a classification loss and a contrastive loss: L = Lfocal + 𝜆(𝑡) · Lsupcon,
(12)
where 𝜆(𝑡) is a time-dependent weight. Focal Loss with Label Smoothing. We adopt Focal Loss [11] with focusing parameter 𝛾 = 2.0 and label smoothing factor 𝜖ls = 0.05. In datasets where anomalous windows constitute as little as 2– 3% of the data (e.g., HDFS), standard cross-entropy is dominated by normal samples. Focal Loss down-weights well-classified samples by (1 − 𝑝𝑡 )𝛾 , directing gradient magnitude toward hard, misclassified anomalous samples. Label smoothing prevents overconfident predictions near the decision threshold. Supervised Contrastive Loss. To learn a feature space where normal and anomalous representations form well-separated clusters, we apply Supervised Contrastive (SupCon) loss [9]. The pooled vector p is passed through a two-layer projection head mapping to a 128-dimensional 𝐿2 -normalized embedding, on which the SupCon loss with temperature 𝜏 = 0.07 is computed. This is particularly valuable because the boundary between normal and anomalous compressed representations is often subtle: an anomalous entry differing from its cached reference by only a few characters may produce a compressed representation that differs by just a handful of bytes. The contrastive loss explicitly amplifies these differences. Dynamic contrastive weight decay. The contrastive weight 𝜆(𝑡) is annealed from 𝜆0 = 0.05 to 𝜆min = 0.005 via a cosine schedule: 𝜆(𝑡) = 𝜆min + 21 (𝜆0 − 𝜆min ) 1 + cos 𝜋𝑡 (13) 𝑇 . Contrastive learning is most beneficial early in fine-tuning, when the feature space needs restructuring; as training progresses, the classification loss should dominate to refine the decision boundary. 3.2.2 Contextual Priority Sampling. Class imbalance in log anomaly detection exhibits a distinctive temporal structure: anomalous events occur in bursts, and windows adjacent to an anomalous window often contain early warning signals or residual effects. We exploit this structure with contextual priority sampling. At each epoch, a fraction 𝜌 = 80% of the training data is sampled nonuniformly: 40% from a priority pool P consisting of all anomalous
windows and their temporal neighbors within ±3 positions, Ø P= { 𝑗 : | 𝑗 − 𝑖 | ≤ 3},
(14)
𝑖 : 𝑦𝑖 =1
and 60% uniformly from D \ P. The remaining 20% is not sampled, serving as an implicit regularizer. This strategy is especially effective in the compressed domain, where near-anomaly windows often exhibit subtle shifts in RLE run length distributions that provide valuable training signal for early anomaly detection. 3.2.3 Data Augmentation via Span Masking. During fine-tuning, 𝑟 = 15% of byte positions are replaced with [MASK] in contiguous spans of 2–5 bytes. Unlike independent random masking, span masking removes entire compressed tokens—an RLE count, a header, or a group of preserved characters—forcing the model to infer the masked region’s contribution from context. This prevents overfitting to superficial byte patterns and improves robustness to variations in compression output arising from changes in the compressor’s sliding window state. 3.2.4 Optimization and Model Selection. We use AdamW [14] with learning rate 3 × 10−4 , weight decay 0.01, 𝛽 1 = 0.9, 𝛽 2 = 0.999, and gradient clipping at norm 1.0. The learning rate follows a 3epoch linear warmup followed by cosine annealing to zero. An Exponential Moving Average (EMA) of model parameters with decay 𝛽 EMA = 0.998 is maintained throughout training. The EMA model is used for validation and testing, as it smooths stochastic gradient noise and produces more stable predictions. Model selection criterion. We use a composite score that jointly penalizes overfitting: Score = 𝐹 1val − 0.2 · L val − 0.1 · L train .
(15)
The inclusion of both loss terms discourages models that achieve high validation F1 through overfitting or lucky evaluation. Early stopping triggers after 7 consecutive epochs without improvement.
4
EXPERIMENTAL EVALUATION
We evaluate CLAD through a comprehensive set of experiments: experimental setup (§4.1) and detection effectiveness (§4.2).
4.1
Experimental Setup
4.1.1 Hardware Environment. All experiments are conducted on a server with an Intel Xeon Gold 6133 CPU @ 2.50 GHz, 93 GB main memory, and an NVIDIA Tesla V100-SXM2 GPU (32 GB). All models are trained and evaluated under identical conditions. 4.1.2 Datasets and Preprocessing. We evaluate on five widely used public benchmarks spanning diverse system architectures, log volumes, and anomaly characteristics [18, 35, 43]. Table 1 summarizes key statistics. BGL. The BlueGene/L dataset [18] comprises 4,747,963 log messages from a supercomputer at Lawrence Livermore National Laboratory. We apply a sliding window strategy with window size 100, yielding 47,479 sequences (4,802 anomalous, 10.11% anomaly ratio). Thunderbird, Liberty, and Spirit. These three supercomputer datasets each contain over 200 million entries [18]. To maintain computational tractability while preserving lifecycle coverage, we design a fixed-interval global sampling strategy: after collecting a
Table 1: Summary of the five benchmark datasets. #Msg. denotes the total number of log entries; #Seq. denotes the number of log sequences after windowing; #Anom. denotes the number of anomalous sequences.
Recall =
𝑇𝑃 , 𝑇𝑃 + 𝐹𝑁
(17)
2 · Precision · Recall . (18) Precision + Recall We additionally report the average F1-score across all five datasets. F1 =
Dataset BGL Thunderbird Liberty Spirit HDFS
Size
#Msg.
#Seq.
#Anom.
0.69 GB 1.40 GB 1.11 GB 1.37 GB 1.47 GB
4,747,963 10,000,000 10,000,000 10,000,000 11,175,629
47,479 100,000 100,000 100,000 575,061
4,802 12,889 66,438 72,283 16,838
contiguous window of 100 entries, a fixed step is skipped before the next window. This yields subsets of exactly 10,000,000 messages per dataset, from which we extract 100,000 sequences each. Thunderbird contains 12,889 anomalous sequences (12.89%), Liberty 66,438 (66.44%), and Spirit 72,283 (72.28%). The high anomaly ratios of Liberty and Spirit provide a challenging testbed for evaluating model behavior under dense anomaly conditions. HDFS. The Hadoop Distributed File System dataset [35] contains 11,175,629 messages from a 203-node cluster. We adopt a session window strategy, grouping entries by block_id to form 575,061 sequences (16,838 anomalous, 2.93%). For BGL, Thunderbird, Liberty, and Spirit, a sequence is labeled anomalous if it contains at least one anomalous entry; for HDFS, labels are assigned at the session level. Data splitting follows a strict chronological 8:2 ratio for the supercomputer datasets (to prevent temporal leakage) and random 8:2 for HDFS. After segmentation and splitting, each sequence is compressed by LogLite-B, which produces a variable-length compressed byte stream. CLAD consumes this byte stream directly as model input. In contrast, all baselines operate on either decompressed raw text or parsed templates. 4.1.3 Baselines. We compare against three representative baselines covering the major paradigms in deep learning–based LAD. CNN [15] operates on parsed log templates using a convolutional neural network, representing parsing-dependent CNN-based methods. LogRobust [41] employs an attention-based Bi-LSTM with TFIDF weighted semantic vectors of parsed templates, representing parsing-dependent RNN-based methods. NeuralLog [10] uses pre-trained BERT embeddings on raw log messages with a Transformer encoder, representing parsing-free methods that still require uncompressed text. Among these, CNN and LogRobust require a log parser; NeuralLog and CLAD do not. Crucially, CLAD is the only method that operates directly on compressed byte streams. 4.1.4 Evaluation Metrics. We report Precision, Recall, and F1score at the window level (or session level for HDFS): Precision =
𝑇𝑃 , 𝑇𝑃 + 𝐹𝑃
(16)
4.2
Detection Effectiveness
Table 2 presents the detection performance of all methods. Overall comparison. CLAD achieves the highest F1-score on all five datasets and the highest average F1 of 0.9909, surpassing the strongest baseline (CNN, 0.9637) by 2.72 percentage points and the best parsing-free baseline (NeuralLog, 0.9616) by 2.93 points. This is noteworthy because CLAD operates on compressed byte streams that have never been decompressed or parsed, yet consistently outperforms methods with access to full uncompressed text or structured parsed templates. The result validates our central hypothesis: the compressed representation preserves—and concentrates—the structural and semantic signals necessary for anomaly detection. Supercomputer datasets (BGL, Thunderbird, Liberty, Spirit). CLAD achieves F1-scores of 0.9645, 0.9991, 0.9970, and 0.9998, respectively. The most significant improvements appear on BGL and Liberty. On BGL, CLAD outperforms the second-best method (CNN) by 0.98 points in F1, driven by a 2.38-point precision improvement. BGL contains diverse anomaly types—hardware faults, memory errors, network failures—that produce distinct signatures in the compressed domain. The four-way aggregation pooling is specifically designed for this heterogeneity: hardware faults create sharp byte-level spikes (captured by max pooling), while gradual degradation shifts the distributional profile (captured by mean pooling). On Liberty, CLAD improves upon CNN by 2.42 points, primarily through a dramatic precision increase (0.9970 vs. 0.9478) while maintaining near-perfect recall (0.9971), indicating far fewer false positives—an essential property for operational deployment. On Thunderbird and Spirit, all methods achieve high F1, but CLAD still attains the best results with near-perfect precision and recall. Distributed system dataset (HDFS). HDFS represents a fundamentally different architecture (distributed storage) with sessionlevel windowing. CLAD achieves 0.9940, slightly surpassing NeuralLog (0.9933) and substantially outperforming CNN (0.9016) and LogRobust (0.9389). The strong performance confirms that CLAD generalizes across system types and windowing strategies. CLAD vs. parsing-dependent methods. Despite having access to clean parsed templates, both CNN and LogRobust are outperformed on every dataset. The most dramatic case is LogRobust on Thunderbird, where precision drops to 0.7385 due to template instability—a failure mode that CLAD, which bypasses parsing entirely, is immune to. CLAD vs. the parsing-free baseline (NeuralLog). CLAD outperforms NeuralLog on all datasets, with the largest margin on BGL (0.9645 vs. 0.8619, a gap of 10.26 points). NeuralLog’s low recall on BGL (0.8250) suggests that word-level semantics struggle with diverse supercomputer vocabulary. In contrast, CLAD operates at the byte level where the compressor has already normalized lexical variability into compact patterns—a natural feature extraction that is robust to vocabulary drift.
Table 2: Detection performance comparison across five benchmark datasets. “Parser” indicates whether the method requires a log parser. The best F1-score on each dataset is shown in bold. CLAD operates directly on compressed byte streams without decompression or parsing. BGL Method
Thunderbird
Liberty
Spirit
HDFS
Avg.
Parser
Prec.
Rec.
F1
Prec.
Rec.
F1
Prec.
Rec.
F1
Prec.
Rec.
F1
Prec.
Rec.
F1
F1
CNN [15] LogRobust [41] NeuralLog [10]
✔ ✔ ✘
0.9530 0.9261 0.9022
0.9564 0.9489 0.8250
0.9547 0.9373 0.8619
0.9986 0.7385 0.9994
0.9968 0.9991 0.9658
0.9977 0.8492 0.9823
0.9478 0.9463 0.9957
0.9990 0.9994 0.9595
0.9728 0.9721 0.9772
0.9837 0.9988 0.9874
0.9996 0.9992 0.9996
0.9916 0.9990 0.9934
0.8932 0.9242 0.9901
0.9101 0.9541 0.9967
0.9016 0.9389 0.9933
0.9637 0.9393 0.9616
CLAD (Ours)
✘
0.9768
0.9530
0.9645
0.9997
0.9986
0.9991
0.9970
0.9971
0.9970
0.9996
0.9999
0.9998
0.9906
0.9974
0.9940
0.9909
Precision–recall balance. Across all datasets, CLAD maintains precision above 0.976 and recall above 0.953, without the trade-off that affects several baselines (e.g., CNN achieves high recall on Liberty but low precision; NeuralLog achieves high precision on HDFS but low recall on BGL). This balanced performance is attributable to the joint focal-contrastive training: Focal Loss preserves recall by attending to the minority class, while SupCon loss maintains precision by enforcing clear separation between normal and anomalous representations.
5
RELATED WORK
We review two lines of research most relevant to CLAD: log anomaly detection and compressed-domain data analysis.
learning for anomaly reasoning. LogSynergy [23] standardizes log syntax across systems via LLM-based event interpretation. CoLA [44] combines a LogMoE filter with a domain-specialized LAD-LLM. Despite strong accuracy and explainability, the prohibitive inference cost of LLMs limits their applicability to high-volume real-time streams. All aforementioned methods—whether sequence-based, graphbased, or LLM-enhanced, parsing-dependent or parsing-free—share a fundamental requirement: decompressed, raw-text log messages as input. CLAD is the first framework to eliminate the entire text-level processing pipeline, establishing a direct path from compressed log ingestion to anomaly prediction.
5.2 5.1
Log Anomaly Detection
Existing methods can be broadly categorized into sequence-based, graph-based, and LLM-enhanced approaches. Sequence-based methods constitute the majority of LAD research. A typical pipeline parses raw messages into event templates and applies detection models to the resulting sequences. DeepLog [3] pioneered this paradigm with LSTM-based next-event prediction. LogAnomaly [17] augmented it by jointly modeling sequential and quantitative patterns with semantic embeddings. LogRobust [41] addressed log instability via attention-based BiLSTM with TF-IDF weighted vectors. PLELog [36] and Pluto [16] tackled semi-supervised and noisy-label settings, respectively, while RT-Log [8] and LogTransfer [2] explored cross-system transferability. MultiLog [40] extended detection to distributed environments through multi-node aggregation. To decouple detection from error-prone parsing, parsing-free approaches have emerged. NeuralLog [10] embeds raw messages via pre-trained word representations and applies a Transformer encoder. LogBERT [6] pre-trains a BERT model via masked log event prediction. Although these methods eliminate explicit parsing, they still require the full-text, decompressed log messages as input. Graph-based methods capture structural dependencies among log events. LogGD [33] employs a Graph Transformer for graphlevel classification. Glad-PAW [27] integrates positional information via weighted graph attention. TP-GNN [12] incorporates temporal dynamics, and SLAD [25] discovers representative substructures via Monte Carlo Tree Search for fine-grained detection. These methods still rely on parsed or raw text to construct the underlying graphs. LLM-enhanced methods leverage large language models for richer semantic understanding. LogGPT [20] explored in-context
Compressed-Domain Data Analysis
Compressed-domain computing spans three primary directions. Grammar-based database computing. TADOC [42] pioneered converting text into hierarchical grammar rules (DAGs) to support operations like frequency counting and string matching via graph traversal. CompressDB [39] extended this to CRUD operations through a “data hole” mechanism. DPTC [7] introduced decompression-transparent compression for fine-grained row-level random access. Most recently, HOCO [5] formalized homomorphic compression with properties such as Directness and Strong Homomorphism, achieving substantial throughput improvements via hash offset mapping and late materialization. Log-oriented retrieval. LogGrep [30] proposed capsule-based indexing for feature matching directly at the compressed level. CLP [21] designed a column-oriented log archive supporting SQLlike queries on compressed data. LogCloud [29] introduced FMindex–based storage enabling keyword search on object storage without decompression. Hardware acceleration. F-TADOC [42] provides an FPGAbased framework for high-throughput CFG traversal. IFGC [4] explored inference-friendly graph compression for executing GNNs on compressed graph structures. While these works have advanced database query acceleration and log retrieval, they are restricted to deterministic operations— keyword matching, regular expressions, and statistical aggregations. They address where relevant entries are in the compressed data but cannot answer what the entries imply. By introducing a semanticaware feature extraction layer operating natively on compressed byte streams, CLAD bridges this gap, elevating compressed-domain computing from shallow retrieval to deep analytical tasks such as anomaly detection.
6
CONCLUSION
We introduce CLAD, the first deep learning framework to perform log anomaly detection directly on compressed byte streams, entirely bypassing the costly decompression and parsing bottlenecks that plague conventional pipelines. By leveraging a purposebuilt architecture that features a multi-scale dilated CNN, a hybrid Transformer-mLSTM, and a two-stage pre-training and fine-tuning strategy, CLAD effectively exploits systematic disruptions in compressed byte patterns without ever recovering the original text. Extensive evaluations confirm its superiority: it achieves a state-ofthe-art average F1-score of 0.9909 across five benchmarks, outperforming the best baseline by 2.72 percentage points while operating exclusively in the compressed domain.
ACKNOWLEDGMENTS This work is supported by the ***.
REFERENCES [1] Maximilian Beck, Korbinian Pöppel, Markus Spanring, Andreas Auer, Oleksandra Prudnikova, Michael Kopp, Günter Klambauer, Johannes Brandstetter, and Sepp Hochreiter. 2024. xlstm: Extended long short-term memory. Advances in Neural Information Processing Systems 37 (2024), 107547–107603. [2] Rui Chen, Shenglin Zhang, Dongwen Li, Yuzhe Zhang, Fangrui Guo, Weibin Meng, Dan Pei, Yuzhi Zhang, Xu Chen, and Yuqing Liu. 2020. Logtransfer: Cross-system log anomaly detection for software systems with transfer learning. In 2020 IEEE 31st International Symposium on Software Reliability Engineering (ISSRE). IEEE, 37–47. [3] Min Du, Feifei Li, Guineng Zheng, and Vivek Srikumar. 2017. Deeplog: Anomaly detection and diagnosis from system logs through deep learning. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security. 1285–1298. [4] Yangxin Fan, Haolai Che, and Yinghui Wu. 2025. Inference-Friendly Graph Compression for Graph Neural Networks. Proceedings of the VLDB Endowment 18, 9 (2025), 3203–3215. [5] Jiawei Guan, Feng Zhang, Siqi Ma, Kuangyu Chen, Yihua Hu, Yuxing Chen, Anqun Pan, and Xiaoyong Du. 2023. Homomorphic compression: Making text processing on compression unlimited. Proceedings of the ACM on Management of Data 1, 4 (2023), 1–28. [6] Haixuan Guo, Shuhan Yuan, and Xintao Wu. 2021. Logbert: Log anomaly detection via bert. In 2021 international joint conference on neural networks (IJCNN). IEEE, 1–8. [7] Hao Hu, Qiyang Zheng, Xiangyu Zou, Lisha Qin, Chengwei Zhang, Wanchuan Zhang, Zhaoheng Jiang, Dingwen Tao, Hongpeng Wang, and Wen Xia. 2025. A cost-effective and decompression-transparent compressor for OLTP-oriented databases. In 2025 IEEE 41st International Conference on Data Engineering (ICDE). IEEE, 405–418. [8] Peng Jia, Shaofeng Cai, Beng Chin Ooi, Pinghui Wang, and Yiyuan Xiong. 2023. Robust and transferable log-based anomaly detection. Proceedings of the ACM on Management of Data 1, 1 (2023), 1–26. [9] Prannay Khosla, Piotr Teterwak, Chen Wang, Aaron Sarna, Yonglong Tian, Phillip Isola, Aaron Maschinot, Ce Liu, and Dilip Krishnan. 2020. Supervised contrastive learning. Advances in neural information processing systems 33 (2020), 18661–18673. [10] Van-Hoang Le and Hongyu Zhang. 2021. Log-based anomaly detection without log parsing. In 2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 492–504. [11] Tsung-Yi Lin, Priya Goyal, Ross Girshick, Kaiming He, and Piotr Dollár. 2017. Focal loss for dense object detection. In Proceedings of the IEEE international conference on computer vision. 2980–2988. [12] Jie Liu, Jiamou Liu, Kaiqi Zhao, Yanni Tang, and Wu Chen. 2024. Tp-gnn: Continuous dynamic graph neural network for graph classification. In 2024 IEEE 40th International Conference on Data Engineering (ICDE). IEEE, 2848–2861. [13] Jinyang Liu, Jieming Zhu, Shilin He, Pinjia He, Zibin Zheng, and Michael R Lyu. 2019. Logzip: Extracting hidden structures via iterative clustering for log compression. In 2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 863–873. [14] Ilya Loshchilov and Frank Hutter. 2017. Decoupled weight decay regularization. arXiv preprint arXiv:1711.05101 (2017). [15] Siyang Lu, Xiang Wei, Yandong Li, and Liqiang Wang. 2018. Detecting anomaly in big data system logs using convolutional neural network. In
2018 IEEE 16th Intl Conf on Dependable, Autonomic and Secure Computing, 16th Intl Conf on Pervasive Intelligence and Computing, 4th Intl Conf on Big Data Intelligence and Computing and Cyber Science and Technology Congress (DASC/PiCom/DataCom/CyberSciTech). IEEE, 151–158. [16] Lei Ma, Lei Cao, Peter M VanNostrand, Dennis M Hofmann, Yao Su, and Elke A Rundensteiner. 2024. Pluto: Sample selection for robust anomaly detection on polluted log data. Proceedings of the ACM on Management of Data 2, 4 (2024), 1–25. [17] Weibin Meng, Ying Liu, Yichen Zhu, Shenglin Zhang, Dan Pei, Yuqing Liu, Yihao Chen, Ruizhi Zhang, Shimin Tao, Pei Sun, et al. 2019. Loganomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs.. In Ijcai, Vol. 19. 4739–4745. [18] Adam Oliner and Jon Stearley. 2007. What supercomputers say: A study of five system logs. In 37th annual IEEE/IFIP international conference on dependable systems and networks (DSN’07). IEEE, 575–584. [19] Aaron van den Oord, Yazhe Li, and Oriol Vinyals. 2018. Representation learning with contrastive predictive coding. arXiv preprint arXiv:1807.03748 (2018). [20] Jiaxing Qi, Shaohan Huang, Zhongzhi Luan, Shu Yang, Carol Fung, Hailong Yang, Depei Qian, Jing Shang, Zhiwen Xiao, and Zhihui Wu. 2023. Loggpt: Exploring chatgpt for log-based anomaly detection. In 2023 IEEE international conference on high performance computing & communications, data science & systems, smart city & dependability in sensor, cloud & big data systems & application (HPCC/DSS/SmartCity/DependSys). IEEE, 273–280. [21] Kirk Rodrigues, Yu Luo, and Ding Yuan. 2021. CLP: Efficient and scalable search on compressed text logs. In 15th USENIX Symposium on Operating Systems Design and Implementation (OSDI 21). 183–198. [22] Noam Shazeer. 2020. Glu variants improve transformer. arXiv preprint arXiv:2002.05202 (2020). [23] Yicheng Sui, Xiaotian Wang, Tianyu Cui, Tong Xiao, Chenghao He, Shenglin Zhang, Yuzhi Zhang, Xiao Yang, Yongqian Sun, and Dan Pei. 2025. Bridging the gap: Llm-powered transfer learning for log anomaly detection in new software systems. In 2025 IEEE 41st International Conference on Data Engineering (ICDE). IEEE, 4414–4427. [24] Benzhao Tang, Shiyu Yang, Zhitao Shen, Wenjie Zhang, Xuemin Lin, and Zhihong Tian. 2025. LogLite: Lightweight Plug-and-Play Streaming Log Compression. Proceedings of the VLDB Endowment 18, 11 (2025), 3757–3770. [25] Yanni Tang, Zhuoxing Zhang, Kaiqi Zhao, Lanting Fang, Zhenhua Li, and Wu Chen. 2024. Substructure-Aware Log Anomaly Detection. Proceedings of the VLDB Endowment 18, 2 (2024), 213–225. [26] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. Advances in neural information processing systems 30 (2017). [27] Yi Wan, Yilin Liu, Dong Wang, and Yujin Wen. 2021. Glad-paw: Graph-based log anomaly detection by position aware weighted graph attention network. In Pacific-asia conference on knowledge discovery and data mining. Springer, 66–77. [28] Rui Wang, Devin Gibson, Kirk Rodrigues, Yu Luo, Yun Zhang, Kaibo Wang, Yupeng Fu, Ting Chen, and Ding Yuan. 2024. 𝜇 Slope: High Compression and Fast Search on Semi-Structured Logs. In 18th USENIX Symposium on Operating Systems Design and Implementation (OSDI 24). 529–544. [29] Ziheng Wang, Junyu Wei, Alex Aiken, Guangyan Zhang, Jacob O Tørring, Rain Jiang, Chenyu Jiang, and Wei Xu. 2025. LogCIoud: Fast Search of Compressed Logs on Object Storage. Proceedings of the VLDB Endowment 18, 8 (2025), 2362– 2370. [30] Junyu Wei, Guangyan Zhang, Junchao Chen, Yang Wang, Weimin Zheng, Tingtao Sun, Jiesheng Wu, and Jiangwei Jiang. 2023. Loggrep: Fast and cheap cloud log storage by exploiting both static and runtime patterns. In Proceedings of the Eighteenth European Conference on Computer Systems. 452–468. [31] Junyu Wei, Guangyan Zhang, Yang Wang, Zhiwei Liu, Zhanyang Zhu, Junchao Chen, Tingtao Sun, and Qi Zhou. 2021. On the feasibility of parser-based log compression in Large-Scale cloud systems. In 19th USENIX Conference on File and Storage Technologies (FAST 21). 249–262. [32] Yuxin Wu and Kaiming He. 2018. Group normalization. In Proceedings of the European conference on computer vision (ECCV). 3–19. [33] Yongzheng Xie, Hongyu Zhang, and Muhammad Ali Babar. 2022. Loggd: Detecting anomalies from system logs with graph neural networks. In 2022 IEEE 22nd International conference on software quality, reliability and security (QRS). IEEE, 299–310. [34] Ruibin Xiong, Yunchang Yang, Di He, Kai Zheng, Shuxin Zheng, Chen Xing, Huishuai Zhang, Yanyan Lan, Liwei Wang, and Tieyan Liu. 2020. On layer normalization in the transformer architecture. In International conference on machine learning. PMLR, 10524–10533. [35] Wei Xu, Ling Huang, Armando Fox, David Patterson, and Michael Jordan. 2009. Online system problem detection by mining patterns of console logs. In 2009 ninth IEEE international conference on data mining. IEEE, 588–597. [36] Lin Yang, Junjie Chen, Zan Wang, Weijing Wang, Jiajun Jiang, Xuyuan Dong, and Wenbin Zhang. 2021. Semi-supervised log-based anomaly detection via probabilistic label estimation. In 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE). IEEE, 1448–1460.
[37] Guangba Yu, Pengfei Chen, Pairui Li, Tianjun Weng, Haibing Zheng, Yuetang Deng, and Zibin Zheng. 2023. Logreducer: Identify and reduce log hotspots in kernel on the fly. In 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE). IEEE, 1763–1775. [38] Biao Zhang and Rico Sennrich. 2019. Root mean square layer normalization. Advances in neural information processing systems 32 (2019). [39] Feng Zhang, Weitao Wan, Chenyang Zhang, Jidong Zhai, Yunpeng Chai, Haixiang Li, and Xiaoyong Du. 2022. CompressDB: Enabling efficient compressed data direct processing for various databases. In Proceedings of the 2022 International Conference on Management of Data. 1655–1669. [40] Lingzhe Zhang, Tong Jia, Mengxi Jia, Ying Li, Yong Yang, and Zhonghai Wu. 2024. Multivariate log-based anomaly detection for distributed database. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 4256–4267.
[41] Xu Zhang, Yong Xu, Qingwei Lin, Bo Qiao, Hongyu Zhang, Yingnong Dang, Chunyu Xie, Xinsheng Yang, Qian Cheng, Ze Li, et al. 2019. Robust log-based anomaly detection on unstable log data. In Proceedings of the 2019 27th ACM joint meeting on European software engineering conference and symposium on the foundations of software engineering. 807–817. [42] Yanliang Zhou, Feng Zhang, Tuo Lin, Yuanjie Huang, Saiqin Long, Jidong Zhai, and Xiaoyong Du. 2024. F-tadoc: Fpga-based text analytics directly on compression with hls. In 2024 IEEE 40th International Conference on Data Engineering (ICDE). IEEE, 3739–3752. [43] Jieming Zhu, Shilin He, Pinjia He, Jinyang Liu, and Michael R. Lyu. 2023. Loghub: A Large Collection of System Log Datasets for AI-driven Log Analytics. In IEEE International Symposium on Software Reliability Engineering (ISSRE). [44] Xuhang Zhu, Xiu Tang, Sai Wu, Jichen Li, Haobo Wang, Chang Yao, Quanqing Xu, and Gang Chen. 2025. CoLA: Model Collaboration for Log-based Anomaly Detection. Proceedings of the VLDB Endowment 18, 11 (2025), 3979–3987.