一句话：提出 CoorLog，用自适应协调器协同小模型与 LLM 检测日志异常，兼顾泛化性与效率。
软件频繁更新导致日志不断演化，使现有日志异常检测方法面临泛化难题。传统方法依赖小型深度学习模型（SM），但其封闭世界假设限制了泛化能力；大语言模型（LLM）具备更强的语义理解与泛化能力，却计算开销高昂。为兼顾效率与泛化，本文提出协同式日志异常检测方案 CoorLog，由自适应协调器判断输入日志是否发生演化：未演化的日志路由至 SM，演化日志则交由 LLM 并借助所构造的 Evol-CoT 进行推理。为逐步适应演化，作者引入自适应演化机制（AEM），利用 LLM 识别出的演化日志更新协调器，使其后续被重定向至 SM，同时微调 SM 以继承 LLM 对这些日志的判定。在真实数据集上的大量实验表明，CoorLog 在版本内与跨版本异常检测中均取得更优的 F1 值，且相比单独使用 LLM 处理时间减少 91.63%、token 消耗减少 85.59%。
Frequent software updates lead to log evolution, posing generalization challenges for current log anomaly detection. Traditional log anomaly detection research focuses on using small deep learning models (SMs), but these models inherently lack generalization due to their closed-world assumption. Large language models (LLMs) exhibit strong semantic understanding and generalization capabilities, making them promising for log anomaly detection. However, they suffer from computational inefficiencies. To balance efficiency and generalization, we propose a collaborative log anomaly detection scheme (CoorLog) that uses an adaptive coordinator to integrate SM and LLM. The coordinator determines if incoming logs have evolved. Non-evolved logs are routed to the SM, while evolved logs are directed to the LLM for detailed inference using the constructed Evol-CoT. To gradually adapt to evolution, we introduce the adaptive evolution mechanism (AEM), which updates the coordinator to redirect evolved logs identified by the LLM to the SM. Simultaneously, the SM is fine-tuned to inherit the LLM’s judgment on these logs. Extensive experiments on real-world datasets demonstrate that CoorLog achieves superior F1-scores in both intra-version and inter-version anomaly detection. Additionally, CoorLog reduces processing time by 91.63% and token consumption by 85.59% compared to using an LLM alone.
DOI 原文 ·
@inproceedings{paperbot9544,
title = {CoorLog: Efficient-Generalizable Log Anomaly Detection via Adaptive Coordinator in Software Evolution},
author = {Pei Xiao and Chiming Duan and Minghua He and Tong Jia and Yifan Wu and Jing Xu and Gege Gao and Lingzhe Zhang and Weijie Hong and Ying Li and Gang Huang},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00097}
}