用思维链+强化学习提升日志异常检测的准确与可信
RationAnomaly: Log Anomaly Detection with Rationality via Chain-of-Thought and Reinforcement Learning
- 用专家推理模式训练模型，让检测过程可解释
- 在多个基准上F1分数超越现有方法
- 适合需要透明、可靠日志分析的运维场景
日志是反映软件系统运行状态的重要证据。自动化日志异常检测对保障现代软件系统的可靠性至关重要。然而，现有方法存在明显局限：传统深度学习模型可解释性差且泛化能力弱，而基于大语言模型的方法常因不可靠和事实错误受阻。为此，我们提出RationAnomaly框架，通过结合思维链（Chain-of-Thought）微调与强化学习，提升日志异常检测性能。首先，利用高质量数据集（经专家严格修正）进行思维链引导的监督微调，注入类专家推理模式；随后，通过多维度奖励函数的强化学习优化，提升准确性与逻辑一致性，有效抑制幻觉。实验表明，RationAnomaly在关键基准上显著优于现有最先进方法，获得更高F1分数，并提供透明、分步的分析输出。相关代码与数据集已开源。
原文摘要 · Abstract (English)
Logs constitute a form of evidence signaling the operational status of software systems. Automated log anomaly detection is crucial for ensuring the reliability of modern software systems. However, existing approaches face significant limitations: traditional deep learning models lack interpretability and generalization, while methods leveraging Large Language Models are often hindered by unreliability and factual inaccuracies. To address these issues, we propose RationAnomaly, a novel framework that enhances log anomaly detection by synergizing Chain-of-Thought (CoT) fine-tuning with reinforcement learning. Our approach first instills expert-like reasoning patterns using CoT-guided supervised fine-tuning, grounded in a high-quality dataset corrected through a rigorous expert-driven process. Subsequently, a reinforcement learning phase with a multi-faceted reward function optimizes for accuracy and logical consistency, effectively mitigating hallucinations. Experimentally, RationAnomaly outperforms state-of-the-art baselines, achieving superior F1-scores on key benchmarks while providing transparent, step-by-step analytical outputs. We have released the corresponding resources, including code and datasets.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。