GeneralLog: Zero-Label Log Anomaly Detection

• GeneralLog is a collaborative framework for zero-label cross-system log anomaly detection that leverages semantic routing to partition logs effectively.
• It uses a dynamic router to separate logs into general (shared) and proprietary (unique) sets, delegating inference to a meta-learned small model or LLM+RAG module.
• GeneralLog achieves state-of-the-art F1 scores (>90%) on benchmark datasets, outperforming traditional methods in accuracy and cost in cold-start scenarios.

GeneralLog is a knowledge-level collaborative framework for zero-label cross-system log anomaly detection, addressing the challenge of robust anomaly detection in settings where the target system provides no labeled log data. Unlike prior small-model transfer or LLM approaches, GeneralLog introduces a dynamic semantic router that partitions unlabeled target-system logs into "general" (shared with source systems) and "proprietary" (unique to the target) subsets, then delegates inference to a meta-learned neural model or LLM+Retrieval-Augmented Generation (RAG) module respectively. This architecture achieves state-of-the-art F1 scores (>90%) under a full cold-start scenario on standard log datasets, providing a cost-effective, accurate solution in environments without labeled anomalies.

1. Problem Formulation and Limitations of Prior Art

The objective is to construct an anomaly detector $f:x\rightarrow \{0,1\}$ that performs well on an entirely unlabeled target-system log dataset $\mathcal{D}_t = \{x_j\}_{j=1}^{N_t}$, using only labeled source-system logs $\mathcal{D}_s = \{(x_i, y_i)\}_{i=1}^{N_s}$ with $y_i \in \{\text{normal}, \text{anomaly}\}$. This setting—zero-label cross-system transfer—differs substantively from conventional transfer learning and unsupervised anomaly detection.

Existing approaches face the following limitations:

• Small-model transfer (e.g., GRU/LSTM with transfer/meta-learning) captures only invariances shared across systems, failing when the target contains templates with semantics or failure modes unseen in the source (target "proprietary logs").
• LLM-based approaches (e.g., few-shot GPT, Qwen3) can adapt to novel templates but require labeled target examples to support robust prompting and entail prohibitive inference cost.
• Hybrid uncertainty-routing strategies, which send "hard" (high-entropy) examples to LLMs and "easy" examples to the small model, lack true knowledge-level separation and rely on output uncertainty that is ill-calibrated in the zero-label setting.

These deficiencies motivate an explicit, domain-aware separation of log knowledge for robust cross-system anomaly detection.

2. GeneralLog Knowledge-Level Routing and System Architecture

GeneralLog introduces a semantic router that assigns unlabeled target logs to processing tracks reflecting their knowledge provenance:

Modular Structure

1. Log Parsing: The Drain algorithm extracts event templates from raw logs.
2. Semantic Embedding: Each log sequence $x_k$ is mapped to a dense vector sequence $\{v_1, \ldots, v_n\}$ in a shared embedding space.
3. Router: A training-free, event-level semantic router computes similarity between $x_k$ and all source log embeddings. For $v_i$ from $x_k$ and $u_j$ from $\mathcal{D}_t = \{x_j\}_{j=1}^{N_t}$0:

$\mathcal{D}_t = \{x_j\}_{j=1}^{N_t}$1

Logs are classified as "general" if $\mathcal{D}_t = \{x_j\}_{j=1}^{N_t}$2, "proprietary" otherwise.

1. Small Model (General): Handles logs with high semantic overlap; employs meta-learned, system-agnostic representations.
2. LLM+RAG (Proprietary): Qwen3 with a RAG knowledge base—uses the top-$\mathcal{D}_t = \{x_j\}_{j=1}^{N_t}$3 general log templates and their inferred labels from the small model as retrievals to contextualize inference.
3. Routing Controller: Computes a soft routing coefficient

$\mathcal{D}_t = \{x_j\}_{j=1}^{N_t}$4

where $\mathcal{D}_t = \{x_j\}_{j=1}^{N_t}$5 is sigmoid, $\mathcal{D}_t = \{x_j\}_{j=1}^{N_t}$6 is the router threshold, and $\mathcal{D}_t = \{x_j\}_{j=1}^{N_t}$7 controls gating steepness.

1. Score Fusion: For each $\mathcal{D}_t = \{x_j\}_{j=1}^{N_t}$8, combine small-model and LLM scores:

$\mathcal{D}_t = \{x_j\}_{j=1}^{N_t}$9

$\mathcal{D}_s = \{(x_i, y_i)\}_{i=1}^{N_s}$0 triggers an anomaly flag.

This explicit partition ensures that general logs—well-represented in the source—are inferred efficiently by the small model, while proprietary logs—unseen in the source—are handled with the semantic flexibility of LLM+RAG inference.

3. Model Components and Learning Objectives

Small Model (General Log Inference)

• Architecture: GRU backbone with self-attention mask.
• Heads: Feature extraction $\mathcal{D}_s = \{(x_i, y_i)\}_{i=1}^{N_s}$1; anomaly prediction $\mathcal{D}_s = \{(x_i, y_i)\}_{i=1}^{N_s}$2; domain discrimination $\mathcal{D}_s = \{(x_i, y_i)\}_{i=1}^{N_s}$3.
• Meta-learning with Adversarial Unsupervised Domain Adaptation (UDA):
  • Define meta-tasks $\mathcal{D}_s = \{(x_i, y_i)\}_{i=1}^{N_s}$4 mixing source and target, with labeled and unlabeled samples.
  • Classification loss: $\mathcal{D}_s = \{(x_i, y_i)\}_{i=1}^{N_s}$5.
  • Domain adaptation loss: $\mathcal{D}_s = \{(x_i, y_i)\}_{i=1}^{N_s}$6.
  • Inner update: $\mathcal{D}_s = \{(x_i, y_i)\}_{i=1}^{N_s}$7 with $\mathcal{D}_s = \{(x_i, y_i)\}_{i=1}^{N_s}$8 weighting.
  • Meta-optimization: $\mathcal{D}_s = \{(x_i, y_i)\}_{i=1}^{N_s}$9.
  • Inference: For general logs, $y_i \in \{\text{normal}, \text{anomaly}\}$0.

LLM+RAG (Proprietary Log Inference)

• Model: Qwen3 with Retrieval-Augmented Generation.
• Knowledge Base: Top-$y_i \in \{\text{normal}, \text{anomaly}\}$1 general log templates from $y_i \in \{\text{normal}, \text{anomaly}\}$2 and their labels (by small model).
• Prompt: Provides labeled general-log templates and queries for anomaly status on proprietary logs.
• Efficiency: Restricts expensive LLM calls to proprietary logs (typically ≤30–40% of all logs); RAG narrows retrieval for cost-containment.

A plausible implication is that, because the router operates in embedding space, its partitioning efficacy depends strongly on the quality of pre-trained or meta-learned representations.

4. Training, Routing, and Inference Workflow

The zero-label pipeline is as follows:

1. Preprocessing: Parse and embed logs in source ($y_i \in \{\text{normal}, \text{anomaly}\}$3) and target ($y_i \in \{\text{normal}, \text{anomaly}\}$4).
2. Meta-learned Small Model: Train on source data with UDA-based meta-learning involving pseudo-tasks mixing labeled and unlabeled samples.
3. RAG Knowledge Base Construction: Store general-log embeddings and their small-model predictions for efficient LLM retrieval.
4. Dynamic Routing:
   • For each log $y_i \in \{\text{normal}, \text{anomaly}\}$5, compute $y_i \in \{\text{normal}, \text{anomaly}\}$6 and $y_i \in \{\text{normal}, \text{anomaly}\}$7.
   • If $y_i \in \{\text{normal}, \text{anomaly}\}$8, assign to small model for $y_i \in \{\text{normal}, \text{anomaly}\}$9; else, query LLM+RAG for $x_k$0.
   • Fuse via $x_k$1 and apply anomaly threshold.
5. Hyperparameter Selection: Choose $x_k$2 by inspecting the empirical distribution of $x_k$3 over $x_k$4 (e.g., 60–80th percentile for thresholding); set $x_k$5 such that $x_k$6 transitions steeply near $x_k$7. No supervision is needed for these selections—distributional heuristics suffice.

5. Empirical Results and Comparative Performance

Extensive experiments on three benchmark log datasets—HDFS (~11M events, ratio ≈ 9:1), BGL (~43M, 15:1), and OpenStack (Thunderbird, ~1.3M, 20:1)—demonstrate:

• GeneralLog (zero-label) achieves F1-scores exceeding 90% across cross-system settings (HDFS→BGL, BGL→HDFS, OpenStack→HDFS, OpenStack→BGL).
• Outperforms zero-label baselines:
  • FreeLog: F1 ranges from 3.3 to 55.9 depending on transfer direction.
  • RAGLog (LLM+KB): F1 ~89–91%.
  • MetaLog (with 1% target labels): F1 ~89–92%.
• Small-model accuracy on general logs remains $x_k$8 when the router threshold $x_k$9 is set strictly; on proprietary logs, accuracy drops below 60%, confirming effective separation.
• Ablation: Removing RAG from LLM inference degrades F1 by 5–8%; omitting meta-learning UDA lowers F1 by 4–6%.

Method	HDFS→BGL	BGL→HDFS	OpenStack→HDFS	OpenStack→BGL
FreeLog	55.9	3.3	8.0	48.2
RAGLog (with KB)	89.1	91.1	91.1	89.1
MetaLog (1% tgt)	92.2	89.6	89.6	92.2
GeneralLog	95.5	94.9	92.0	92.3

A plausible implication is that knowledge-level routing and RAG mitigate both domain-mismatch and efficiency obstacles that afflict prior methods.

6. Strengths, Limitations, and Future Directions

Strengths:

• Achieves robust zero-label cross-system detection by explicit knowledge separation, outperforming both pure small-model and LLM-only baselines.
• Maintains high cost-effectiveness by reserving expensive LLM inference for a fraction (≤40%) of logs.
• F1 performance above 90% under full cold-start.

Limitations:

• Router threshold $\{v_1, \ldots, v_n\}$0 is selected heuristically based on similarity distributions, lacking a statistical or learned criterion.
• RAG knowledge base labels, if inaccurate, can propagate errors to LLM guidance.
• Logs with proprietary patterns partially overlapping general logs may not receive optimal LLM context, especially if retrieval is too narrow.

Future research is suggested in:

1. Replacing heuristic routing with learned or contrastive classifiers to further automate $\{v_1, \ldots, v_n\}$1 selection.
2. Compressing LLM knowledge into the small model via distillation, further reducing inference cost.
3. Extending the approach to incorporate multi-modal proprietary knowledge (documentation, configs).
4. Enabling continuous adaptation: updating routing and RAG knowledge in an online fashion as logs from new systems accumulate.

GeneralLog formalizes a knowledge-level approach to routing and model selection in zero-label, cross-domain log anomaly detection, furnishing a comprehensive and empirically validated framework for scalable deployment in heterogeneous real-world software systems (Zhao et al., 8 Nov 2025).