Papers › LogGPT: Log Anomaly Detection via GPT

LogGPT: Log Anomaly Detection via GPT

25 Sep 2023arXiv:2309.14482archive 2025-07-28

Xiao Han, Shuhan Yuan, Mohamed Trabelsi

Detecting system anomalies based on log data is important for ensuring the security and reliability of computer systems. Recently, deep learning models have been widely used for log anomaly detection. The core idea is to model the log sequences as natural language and adopt deep sequential models, such as LSTM or Transformer, to encode the normal patterns in log sequences via language modeling. However, there is a gap between language modeling and anomaly detection as the objective of training a sequential model via a language modeling loss is not directly related to anomaly detection. To fill up the gap, we propose LogGPT, a novel framework that employs GPT for log anomaly detection. LogGPT is first trained to predict the next log entry based on the preceding sequence. To further enhance the performance of LogGPT, we propose a novel reinforcement learning strategy to finetune the model specifically for the log anomaly detection task. The experimental results on three datasets show that LogGPT significantly outperforms existing state-of-the-art approaches.

PaperPDFCode

Code

nokia/LogGPT officialmentioned in papermentioned on GitHubpytorch report

Repository list and official/mentioned flags are the archive's, frozen 2025-07-28. Reachability, where shown, is from one Syntology probe window (2026-09-16 to 2026-09-18); repositories not probed show nothing. GitHub stars are not tracked.

Code Syntology ran Syntology

Not run by Syntology. Nothing on this page verifies that the listed code works.

Tasks

Anomaly DetectionLanguage ModelingLanguage Modelling

Results from the paper archive 2025-07-28

No leaderboard rows for this paper in the archive.

Methods

Absolute Position EncodingsAdamAttentionAttention DropoutBPECosine AnnealingDense ConnectionsDiscriminative Fine-TuningDropoutGPTLSTMLabel SmoothingLayer NormalizationLinear LayerLinear Warmup With Cosine AnnealingMulti-Head AttentionPosition-Wise Feed-Forward LayerResidual ConnectionSigmoid ActivationSoftmaxTanh ActivationTransformerWeight Decay

Report a problem or propose a change · a person checks every report against the paper or source before anything changes; decisions are listed on /corrections