一句话：提出CLSLog，通过语义相似度二分类协同大语言模型与小模型，提升演化日志异常检测准确率并降低检测开销。
随着软件系统日益复杂，基于日志的异常检测在软件演化产生的演化日志上尤为困难。小规模深度学习模型虽高效，但难以处理偏离训练分布的演化日志；大语言模型能利用日志中的丰富语义信息，却存在效率低、缺乏领域知识的问题。为此，论文提出CLSLog协同方案，将日志异常检测建模为语义相似度二分类任务，使大、小模型在语义理解层面协作：小模型为非演化日志提供可靠且快速的检测结果；对于演化日志，则利用小模型的预测与中间结果增强大语言模型，为其注入领域特定知识。作者在两个公开数据集上进行初步实验，结果表明该组合方法优于单独使用任一模型，取得更高准确率，同时减少检测时间与成本。
As software systems become more complex, ensuring reliability through log-based anomaly detection presents significant challenges, particularly when dealing with evolutionary logs generated during software evolution. While small deep learning models (SM) have been employed for log anomaly detection, they struggle with handling evolutionary logs that deviate from the training distribution. On the other hand, large language models (LLMs) show great potential in leveraging the rich semantic information in logs but suffer from inefficiencies and lack domain-specific knowledge. To address these challenges, we propose CLSLog, a collaborative scheme that leverages the generalization capabilities of LLMs and the efficiency and low-cost advantages of small models. We model log anomaly detection as a semantic similarity binary classification task to enable collaboration between small and large models at the semantic understanding level. The small model accelerates the detection process by providing reliable results for non-evolutionary logs, while for evolutionary logs, the small model's predictions and intermediate results help enhance the LLM with domain-specific knowledge. Preliminary experimental results on two open dataseys demonstrate that this combined approach outperforms using either model individually, achieving higher accuracy and reducing detection time and costs.
@inproceedings{paperbot8955,
title = {CLSLog: Collaborating Large and Small Models for Log-based Anomaly Detection},
author = {Pei Xiao and Tong Jia and Chiming Duan and Minghua He and Weijie Hong and Xixuan Yang and Yihan Wu and Ying Li and Gang Huang},
booktitle = {FSE},
year = {2025},
doi = {10.1145/3696630.3728524}
}