通过分层抽象重构日志结构，实现更准更快的异常检测。
KRONE: Scalable LLM-Augmented Log Anomaly Detection via Hierarchical Abstraction
- 从扁平日志自动构建执行层级，拆分为可独立检测的模块化单元
- 在三个公开数据集和字节跳动工业数据上提升准确率至87.98%，F1提高10.07%
- 仅需1.1%~3.3%的LLM调用，兼顾效率与可解释性
日志异常检测对发现系统故障和安全风险至关重要。尽管日志源自具有明确边界的嵌套组件执行，但存储为扁平序列后，其结构信息丢失，导致现有方法常遗漏真实依赖关系，误学无关事件间的虚假关联。本文提出KRONE，首个基于分层抽象的日志异常检测框架，能自动从扁平日志中推导出执行层级，实现模块化、多层级异常检测。核心的KRONE日志抽象模型提取应用特定语义层级，递归将日志序列分解为称为KRONE Seq的连贯执行单元，将序列级检测转化为一系列模块化单元级任务。针对每个测试的KRONE Seq，KRONE采用混合检测策略：在快速过滤阶段使用不依赖层级的局部上下文检测器，再通过考虑跨层级语义依赖的嵌套感知检测器进行精细判断，并结合大语言模型增强异常检测与解释能力。同时，通过缓存结果复用和层次早停策略优化检测效率。在三个公开基准及字节跳动云平台工业数据集上的实验表明，KRONE在准确率（42.49%到87.98%）、F1分数、数据效率（降低117.3倍）、资源效率（降低43.7倍）和可解释性方面均有显著提升。相比之前方法，F1得分提升10.07%（82.76%到92.83%），且仅需1.1%至3.3%的测试数据调用大语言模型。
原文摘要 · Abstract (English)
Log anomaly detection is crucial for uncovering system failures and security risks. Although logs originate from nested component executions with clear boundaries, this structure is lost when stored as flat sequences. As a result, state-of-the-art methods often miss true dependencies within executions while learning spurious correlations across unrelated events. We propose KRONE, the first hierarchical anomaly detection framework that automatically derives execution hierarchies from flat logs to enable modular, multi-level anomaly detection. At its core, the KRONE Log Abstraction Model extracts application-specific semantic hierarchies, which are used to recursively decompose log sequences into coherent execution units, referred to as KRONE Seqs. This transforms sequence-level detection into a set of modular KRONE Seq-level detection tasks. For each test KRONE Seq, KRONE adopts a hybrid modular detection strategy that routes between an efficient level-independent Local-Context detector for rapid filtering and a Nested-Aware detector that captures cross-level semantic dependencies, augmented with LLM-based anomaly detection and explanation. KRONE further optimizes detection through cached result reuse and early-exit strategies along the hierarchy. Experiments on three public benchmarks and one industrial dataset from ByteDance Cloud demonstrate that KRONE achieves substantial improvements in accuracy (42.49% to 87.98%), F1 score, data efficiency (117.3x reduction), resource efficiency (43.7x reduction), and interpretability. KRONE improves F1-score by 10.07% (82.76% to 92.83%) over prior methods while reducing LLM usage to only 1.1% to 3.3% of the test data. Code: https://github.com/LeiMa0324/KRONE Demo: https://leima0324.github.io/KRONE_Demo_official/
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。