一句话：提出 GeneralLog，通过 LLM 与小模型按知识级动态路由，实现零标签跨系统日志异常检测。
跨系统日志异常检测可缓解目标系统标注日志稀缺问题，但现有小模型方法只迁移通用知识，忽略目标系统专有知识；LLM 方法虽能捕获专有模式，却依赖少量正例、推理成本高、效率低；已有 LLM–小模型协作按不确定性路由，在无目标标签场景无法度量样本复杂度。为此，本文提出 GeneralLog，对未标注目标日志进行知识级动态路由：让 LLM 处理“专有日志”，小模型处理“通用日志”，从而在零标签条件下实现跨系统泛化。在三个不同系统的公开日志数据集上，GeneralLog 在完全零标签设置下 F1 超过 90%，显著优于现有跨系统方法。
Log-based anomaly detection is crucial for ensuring the stability and reliability of software systems. However, the scarcity of labeled logs severely constrains the rapid deployment of existing methods to new systems. To address this issue, cross-system transfer has been recognized as an important research direction. State-of-the-art cross-system approaches can achieve strong performance when a small amount of labeled target logs is available, but several limitations remain: methods based on small models focus solely on transferring general knowledge and thus overlook the discrepancies and potential mismatches between general knowledge and the target system’s proprietary knowledge; methods based on LLMs can capture proprietary patterns but often rely on guidance from a few positive examples and are constrained by high inference cost and low inference efficiency. Existing LLM–small model collaboration strategies typically quantify sample complexity via the small model’s output uncertainty, assigning “simple logs” to the small model and “complex logs” to the LLM. However, in the cross-system setting without target labels, sample complexity cannot be measured in a unsupervised manner, and such routing mechanisms are not designed from the perspective of knowledge separation. Therefore, they are not directly applicable to zero-label cross-system log-based anomaly detection. To address these issues, we propose GeneralLog, a novel LLM–small model collaborative method for zero-label cross-system log-based anomaly detection. GeneralLog performs knowledge-level dynamic routing of unlabeled target logs, allowing the LLM to process “proprietary logs” while the small model handles “general logs,” thereby achieving cross-system generalization without requiring labeled target logs. Experiments on three public log datasets from different systems show that, under a fully zero-label setting, GeneralLog achieves an F1-score over 90%, significantly outperforming existing state-of-the-art cross-system methods.
@inproceedings{paperbot11996,
title = {Generality Is Not Enough: Zero-Label Cross-System Log-Based Anomaly Detection via Knowledge-Level Collaboration},
author = {Xinlong Zhao and Tong Jia and Minghua He and Ying Li},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3786582.3786811}
}