{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,25]],"date-time":"2026-04-25T14:59:03Z","timestamp":1777129143905,"version":"3.51.4"},"reference-count":40,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2022,2,24]],"date-time":"2022-02-24T00:00:00Z","timestamp":1645660800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Symmetry"],"abstract":"<jats:p>System logs record the status and important events of the system at different time periods. They are important resources for administrators to understand and manage the system. Detecting anomalies in logs is critical to identifying system faults in time. However, with the increasing size and complexity of today\u2019s software systems, the number of logs has exploded. In many cases, the traditional manual log-checking method becomes impractical and time-consuming. On the other hand, existing automatic log anomaly detection methods are error-prone and often use indices or log templates. In this work, we propose LogLS, a system log anomaly detection method based on dual long short-term memory (LSTM) with symmetric structure, which regarded the system log as a natural-language sequence and modeled the log according to the preorder relationship and postorder relationship. LogLS is optimized based on the DeepLog method to solve the problem of poor prediction performance of LSTM on long sequences. By providing a feedback mechanism, it implements the prediction of logs that do not appear. To evaluate LogLS, we conducted experiments on two real datasets, and the experimental results demonstrate the effectiveness of our proposed method in log anomaly detection.<\/jats:p>","DOI":"10.3390\/sym14030454","type":"journal-article","created":{"date-parts":[[2022,2,24]],"date-time":"2022-02-24T21:11:52Z","timestamp":1645737112000},"page":"454","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":31,"title":["LogLS: Research on System Log Anomaly Detection Method Based on Dual LSTM"],"prefix":"10.3390","volume":"14","author":[{"given":"Yiyong","family":"Chen","sequence":"first","affiliation":[{"name":"College of Information Science and Engineering, Xinjiang University, Urumqi 830046, China"}]},{"given":"Nurbol","family":"Luktarhan","sequence":"additional","affiliation":[{"name":"College of Information Science and Engineering, Xinjiang University, Urumqi 830046, China"}]},{"given":"Dan","family":"Lv","sequence":"additional","affiliation":[{"name":"College of Information Science and Engineering, Xinjiang University, Urumqi 830046, China"}]}],"member":"1968","published-online":{"date-parts":[[2022,2,24]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Fotiadou, K., Velivassaki, T.H., Voulkidis, A., Skias, D., De Santis, C., and Zahariadis, T. (2020). Proactive Critical Energy Infrastructure Protection via Deep Feature Learning. Energies, 13.","DOI":"10.3390\/en13102622"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Wang, B., Ying, S., Cheng, G., and Li, Y. (2020, January 11\u201314). A log-based anomaly detection method with the NW ensemble rules. Proceedings of the 2020 IEEE 20th International Conference on Software Quality, Reliability and Security (QRS), Macau, China.","DOI":"10.1109\/QRS51102.2020.00022"},{"key":"ref_3","unstructured":"Rouillard, J.P. (2004, January 14\u201319). Real-time Log File Analysis Using the Simple Event Correlator (SEC). Proceedings of the Conference on Systems Administration, Atlanta, GA, USA."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"58088","DOI":"10.1109\/ACCESS.2021.3071763","article-title":"Intrusion Detection Based on Sequential Information Preserving Log Embedding Methods and Anomaly Detection Algorithms","volume":"9","author":"Kim","year":"2021","journal-title":"IEEE Access"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Xu, W., Huang, L., Fox, A., Patterson, D., and Jordan, M. (2010, January 21\u201324). Detecting Large-Scale System Problems by Mining Console Logs. Proceedings of the 26 th International Conference on Machine Learning, Haifa, Israel.","DOI":"10.1145\/1629575.1629587"},{"key":"ref_6","unstructured":"Lou, J.G., Fu, Q., Yang, S., Xu, Y., and Li, J. (2010, January 23\u201325). Mining invariants from console logs for system problem detection. Proceedings of the 2010 USENIX Annual Technical Conference, Boston, MA, USA."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Lou, J.G., Fu, Q., Yang, S., Li, J., and Wu, B. (2010, January 25\u201328). Mining program workflow from interleaved traces. Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Washington, DC, USA.","DOI":"10.1145\/1835804.1835883"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Lin, Q., Zhang, H., Lou, J.G., Zhang, Y., and Chen, X. (2016, January 14\u201322). Log clustering based problem identification for online service systems. Proceedings of the 2016 IEEE\/ACM 38th International Conference on Software Engineering Companion (ICSE-C), Austin, TX, USA.","DOI":"10.1145\/2889160.2889232"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Yang, L., Chen, J., Wang, Z., Wang, W., Jiang, J., Dong, X., and Zhang, W. (2021, January 22\u201330). Semi-Supervised Log-Based Anomaly Detection via Probabilistic Label Estimation. Proceedings of the 2021 IEEE\/ACM 43rd International Conference on Software Engineering (ICSE), Madrid, Spain.","DOI":"10.1109\/ICSE43902.2021.00130"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Bodik, P., Goldszmidt, M., Fox, A., Woodard, D.B., and Andersen, H. (2010, January 13). Fingerprinting the datacenter: Automated classification of performance crises. Proceedings of the ACM EuroSys Conference on Computer Systems, EuroSys\u2019 10, New York, NY, USA.","DOI":"10.1145\/1755913.1755926"},{"key":"ref_11","first-page":"50","article-title":"Anomaly detection for log sequence based on improved temporal convolutional network","volume":"46","author":"Yang","year":"2020","journal-title":"Comput. Eng."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Phyo, P.P., and Byun, Y.C. (2021). Hybrid Ensemble Deep Learning-Based Approach for Time Series Energy Prediction. Symmetry, 13.","DOI":"10.3390\/sym13101942"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Wang, M., Xu, L., and Guo, L. (2018, January 24\u201327). Anomaly Detection of System Logs Based on Natural Language Processing and Deep Learning. Proceedings of the 2018 4th International Conference on Frontiers of Signal Processing (ICFSP), Poitiers, France.","DOI":"10.1109\/ICFSP.2018.8552075"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"285","DOI":"10.1007\/s10796-020-10026-3","article-title":"LogGAN: A Log-level Generative Adversarial Network for Anomaly Detection using Permutation Event Modeling","volume":"23","author":"Xia","year":"2021","journal-title":"Inf. Syst. Front."},{"key":"ref_15","unstructured":"Du, M., Li, F., Zhang, G., and SriKumar, V. (November, January 30). DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning. Proceedings of the Acm Sigsac Conference on Computer & Communications Security, Dallas, TX, USA."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Zhang, X., Xu, Y., Lin, Q., Qiao, B., Zhang, H., Dang, Y., Xie, C., Yang, X., Cheng, Q., and Li, Z. (2019, January 26\u201330). Robust Log-Based Anomaly Detection on Unstable Log Data. Proceedings of the 27th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC\/FSE \u201919), Tallinn, Estonia.","DOI":"10.1145\/3338906.3338931"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Nedelkoski, S., Bogatinovski, J., Acker, A., Cardoso, J., and Kao, O. (2020, January 17\u201320). Self-Attentive Classification-Based Anomaly Detection in Unstructured Logs. Proceedings of the 2020 IEEE International Conference on Data Mining (ICDM), Sorrento, Italy.","DOI":"10.1109\/ICDM50108.2020.00148"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"2213","DOI":"10.1109\/TKDE.2018.2875442","article-title":"Spell: Online Streaming Parsing of Large Unstructured System Logs","volume":"31","author":"Du","year":"2018","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Du, M., and Li, F. (2016, January 12\u201315). Spell: Streaming Parsing of System Event Logs. Proceedings of the 2016 IEEE 16th International Conference on Data Mining (ICDM), Barcelona, Spain.","DOI":"10.1109\/ICDM.2016.0103"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Yu, X., Joshi, P., Xu, J., Jin, G., Zhang, H., and Jiang, G. (2016, January 25). CloudSeer: Workflow Monitoring of Cloud Infrastructures via Interleaved Logs. Proceedings of the Twenty-First International Conference, New York, NY, USA.","DOI":"10.1145\/2872362.2872407"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"172","DOI":"10.1016\/j.jss.2018.05.016","article-title":"Execution Anomaly Detection in Large-scale Systems through Console Log Analysis","volume":"143","author":"Bao","year":"2018","journal-title":"J. Syst. Softw."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Fu, Q., Lou, J.G., Wang, Y., and Li, J. (2009, January 6\u20139). Execution Anomaly Detection in Distributed Systems through Unstructured Log Analysis. Proceedings of the 2009 Ninth IEEE International Conference on Data Mining, Miami Beach, FL, USA.","DOI":"10.1109\/ICDM.2009.60"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Dai, H., Li, H., Chen, C.S., Shang, W., and Chen, T.H. (2020). Logram: Efficient Log Parsing Using n-Gram Dictionaries. IEEE Trans. Softw. Eng.","DOI":"10.1109\/TSE.2020.3007554"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"He, P., Zhu, J., Zheng, Z., and Lyu, M.R. (2017, January 25\u201330). Drain: An Online Log Parsing Approach with Fixed Depth Tree. Proceedings of the IEEE International Conference on Web Services, Honolulu, HI, USA.","DOI":"10.1109\/ICWS.2017.13"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Zhu, J., He, S., Liu, J., He, P., and Lyu, M.R. (2019, January 1). Tools and Benchmarks for Automated Log Parsing. Proceedings of the Tools and Benchmarks for Automated Log Parsing, Montreal, QC, Canada.","DOI":"10.1109\/ICSE-SEIP.2019.00021"},{"key":"ref_26","unstructured":"He, P., Zhu, J., He, S., Li, J., and Lyu, M.R. (July, January 28). An evaluation study on log parsing and its use in log mining. Proceedings of the 37th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks, Toulouse, France."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Alanis, A.Y., Sanchez, O.D., and Alvarez, J.G. (2021). Time Series Forecasting for Wind Energy Systems Based on High Order Neural Networks. Mathematics, 9.","DOI":"10.3390\/math9101075"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Nandanwar, A.K., and Choudhary, J. (2021). Semantic Features with Contextual Knowledge-Based Web Page Categorization Using the GloVe Model and Stacked BiLSTM. Symmetry, 13.","DOI":"10.3390\/sym13101772"},{"key":"ref_29","unstructured":"Ian, G., Yoshua, B., and Aaron, C. (2016). Deep Learning, MIT Press. [1st ed.]."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"1735","DOI":"10.1162\/neco.1997.9.8.1735","article-title":"Long Short-term Memory","volume":"9","author":"Hochreiter","year":"1997","journal-title":"Neural Comput."},{"key":"ref_31","unstructured":"(2020, October 14). Understanding LSTM Networks. Available online: http:\/\/colah.github.io\/posts\/2015-08-Understanding-LSTMs\/."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"319","DOI":"10.1049\/el.2018.7980","article-title":"Trimmed categorical cross-entropy for deep learning with label noise","volume":"55","author":"Rusiecki","year":"2019","journal-title":"Electron. Lett."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Oprea, A., Li, Z., Yen, T.F., Chin, S.H., and Alrwais, S. (2015, January 22\u201325). Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data. Proceedings of the 2015 45th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks, Rio de Janeiro, Brazil.","DOI":"10.1109\/DSN.2015.14"},{"key":"ref_34","unstructured":"(2020, October 02). Keras. Available online: https:\/\/github.com\/keras-team\/keras."},{"key":"ref_35","unstructured":"Abadi, M., Barham, P., Chen, J., Chen, Z., Davis, A., Dean, J., Devin, M., Ghemawat, S., Irving, G., and Isard, M. (2016, January 2\u20134). TensorFlow: A system for large-scale machine learning. Proceedings of the 12th USENIX Conference on Operating Systems Design and Implementation, Savannah, GA, USA."},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Xu, W., Huang, L., Fox, A., Patterson, D., and Jordan, M. (2009, January 6\u20139). Online System Problem Detection by Mining Patterns of Console Logs. Proceedings of the 2009 Ninth IEEE International Conference on Data Mining, Miami Beach, FL, USA.","DOI":"10.1109\/ICDM.2009.19"},{"key":"ref_37","unstructured":"Prewett, J.E. (,  2003). Analyzing cluster log files using Logsurfer. Proceedings of the Annual Conference on Linux Clusters, Available online: https:\/\/www.semanticscholar.org\/paper\/Analyzing-cluster-log-files-using-Logsurfer-Prewett\/d9a2a773348e6dc1c0bef303cf188145267bd8c1."},{"key":"ref_38","first-page":"105","article-title":"Research on system log anomaly detection based on deep learning","volume":"5","author":"Wang","year":"2019","journal-title":"Chin. J. Netw. Inf. Secur."},{"key":"ref_39","first-page":"303","article-title":"System Anomaly Detection Method Based on Bidirectional LSTM","volume":"12","author":"Zhang","year":"2020","journal-title":"Comput. Appl. Softw."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Oliner, A., and Stearley, J. (2007, January 25\u201328). What supercomputers say: A study of five system logs. Proceedings of the 37th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks, Edinburgh, UK.","DOI":"10.1109\/DSN.2007.103"}],"container-title":["Symmetry"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-8994\/14\/3\/454\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T22:26:00Z","timestamp":1760135160000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-8994\/14\/3\/454"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,2,24]]},"references-count":40,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2022,3]]}},"alternative-id":["sym14030454"],"URL":"https:\/\/doi.org\/10.3390\/sym14030454","relation":{},"ISSN":["2073-8994"],"issn-type":[{"value":"2073-8994","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,2,24]]}}}