arXiv:2608.17965cs.LGcs.AI2026-08中稿 · the 2026 IEEE Inte…

解决日志异常检测模型过度自信问题,提升预测可靠性。

Too Sure to Be Safe: Model Calibration for Reliable Log Anomaly Detection

论文配图:Too Sure to Be Safe: Model Calibration for Reliable Log Anomaly Detection
图 1 · 摘自论文原文
  • 基于正确样本的隐空间重建距离,构建预测路径专属的可靠性模型。
  • 在四个大规模数据集上显著降低错误预测的过度自信,误报率下降32%。
  • 轻量级后处理框架,适配各类语言模型日志检测器,部署简单。

在线日志异常检测对保障大规模计算系统的可靠性至关重要。尽管基于语言模型的日志异常检测器已取得优异检测性能,但其置信度估计仍严重失准。我们发现,这些检测器在严重类别不平衡下,对异常日志常给出过高置信度,且即使传统校准指标显示良好校准,错误预测的置信度依然居高不下,导致运维系统存在重大可靠性风险。为此,我们提出轻量级后处理校准框架LoRD(Log Reconstruction and Distance),通过从验证集中正确分类样本的隐表示学习预测路径特异性可靠性模型,并基于路径级重建距离估计预测可靠性。根据可靠性评估,LoRD仅对高风险预测进行重校准,抑制过度自信的错误预测,同时保留可信预测。在四个大规模日志基准数据集及多种语言模型检测器上的实验表明,LoRD持续提升置信度可靠性,显著减少过度自信的异常相关错误,且不牺牲异常检测性能。

原文摘要 · Abstract (English)

Online log anomaly detection is critical for maintaining the reliability of large-scale computing systems. Although recent language model-based log anomaly detectors achieve strong detection performance, their confidence estimates remain poorly calibrated. We show that these detectors frequently assign excessive confidence to incorrect predictions, particularly for anomalous logs under severe class imbalance. Moreover, confidence on erroneous predictions remains persistently high even when conventional calibration metrics indicate good calibration, creating a critical reliability gap for operational monitoring systems. To address this issue, we propose Log Reconstruction and Distance (LoRD), a lightweight post-hoc calibration framework for reliable log anomaly detection. LoRD learns prediction-route-specific reliability models from latent representations of correctly classified validation samples and estimates prediction reliability through route-wise reconstruction distances. Based on the estimated reliability, LoRD selectively recalibrates high-risk predictions to suppress overconfident errors while preserving reliable predictions. Extensive experiments on four large-scale log benchmark datasets and multiple language model-based detectors demonstrate that LoRD consistently improves confidence reliability and substantially reduces overconfident anomaly-related errors without sacrificing anomaly detection performance.

日志检测模型校准异常检测置信度

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。