AnomalyGen: Enhancing Log-Based Anomaly Detection with Code-Guided Data Augmentation

• URL: http://arxiv.org/abs/2604.11107v1
• Date: Mon, 13 Apr 2026 07:24:43 GMT
• Title: AnomalyGen: Enhancing Log-Based Anomaly Detection with Code-Guided Data Augmentation
• Abstract summary: AnomalyGen is a novel framework that augments training data by synthesizing labeled log sequences from source code.<n> Evaluations on HDFS and Zookeeper across 12 diverse anomaly detection models show AnomalyGen consistently improves performance.
• Score: 42.87177529900358
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Log-based anomaly detection is fundamentally constrained by training data sparsity. Our empirical study reveals that public benchmark datasets cover less than 10% of source code log templates. Consequently, models frequently misclassify unseen but valid execution paths as anomalies, leading to false alarms. To address this, we propose AnomalyGen, a novel framework that augments training data by synthesizing labeled log sequences from source code. AnomalyGen combines log-oriented static analysis with Large Language Model (LLM) reasoning in three stages: (1) building Log-Oriented Control Flow Graphs (LCFGs) to enumerate structurally valid execution paths; (2) applying LLM Chain-of-Thought (CoT) reasoning to verify logical consistency and generate realistic runtime parameters (e.g., block IDs, IP addresses); and (3) labeling generated sequences with domain heuristics. Evaluations on HDFS and Zookeeper across 12 diverse anomaly detection models show AnomalyGen consistently improves performance. Deep learning models achieved average F1-score gains of 2.18% (HDFS) and 1.69% (Zookeeper), with an unsupervised Transformer on HDFS jumping from 0.818 to 0.970. Ablation results show that both static analysis and LLM-based verification are necessary: removing them reduces F1 by up to 8.7 and 10.7 percentage points, respectively. Our framework and datasets are publicly available to facilitate future research.

Related papers

• MCPShield: Content-Aware Attack Detection for LLM Agent Tool-Call Traffic [1.827510863075184]
  The Model Context Protocol (MCP) has become a widely adopted interface for agents to invoke external tools.<n> MCP is presented as an attack framework for MCP tool-call traffic that encodes each agent session as a graph.
  arXiv  Detail & Related papers  (2026-05-11T14:55:48Z)
• LLM-Enhanced Log Anomaly Detection: A Comprehensive Benchmark of Large Language Models for Automated System Diagnostics [0.0]
  Large Language Models (LLMs) offer promising new approaches to log understanding.<n>LLMs demonstrate remarkablezero-shot capabilities without requiring any labeled training data.<n>Our findings provide actionable guidelines for choosing log anomaly detection methods.
  arXiv  Detail & Related papers  (2026-04-14T02:51:48Z)
• EAGLE: Edge-Aware Graph Learning for Proactive Delivery Delay Prediction in Smart Logistics Networks [0.5653106385738822]
  We propose a hybrid deep learning framework for proactive supply chain risk management.<n>The proposed method jointly models temporal order-flow dynamics via a lightweight Transformer patch encoder.<n>The framework exhibits a cross-seed F1 standard deviation of only 0.0089 -- a 3.8 times improvement over the best ablated variant.
  arXiv  Detail & Related papers  (2026-04-06T23:35:15Z)
• AlgoVeri: An Aligned Benchmark for Verified Code Generation on Classical Algorithms [54.99368693313797]
  Existing benchmarks test only individual languages/tools, so the performance numbers are not directly comparable.<n>We address this gap with AlgoVeri, a benchmark that evaluates vericoding of $77$ classical algorithms in Dafny, Verus, and Lean.
  arXiv  Detail & Related papers  (2026-02-10T06:58:26Z)
• CVeDRL: An Efficient Code Verifier via Difficulty-aware Reinforcement Learning [57.24524263804788]
  Code verifiers play a critical role in post-verification for LLM-based code generation.<n>Existing supervised fine-tuning methods suffer from data scarcity, high failure rates, and poor inference efficiency.<n>We show that naive RL with only functionality rewards fails to generate effective unit tests for difficult branches and samples.
  arXiv  Detail & Related papers  (2026-01-30T10:33:29Z)
• Benchmarking Small Language Models and Small Reasoning Language Models on System Log Severity Classification [3.192782465393035]
  We argue that severity classification is more informative when treated as a benchmark for probing runtime log comprehension rather than as an end task.<n>We evaluate nine small language models (SLMs) and small reasoning language models (SRLMs) under zero-shot, few-shot, and retrieval-augmented generation (RAG) prompting.
  arXiv  Detail & Related papers  (2026-01-12T18:02:33Z)
• Learning Efficient and Generalizable Graph Retriever for Knowledge-Graph Question Answering [75.12322966980003]
  Large Language Models (LLMs) have shown strong inductive reasoning ability across various domains.<n>Most existing RAG pipelines rely on unstructured text, limiting interpretability and structured reasoning.<n>Recent studies have explored integrating knowledge graphs with LLMs for knowledge graph question answering.<n>We propose RAPL, a novel framework for efficient and effective graph retrieval in KGQA.
  arXiv  Detail & Related papers  (2025-06-11T12:03:52Z)
• Gated Attention for Large Language Models: Non-linearity, Sparsity, and Attention-Sink-Free [81.65559031466452]
  We conduct experiments to investigate gating-augmented softmax attention variants.<n>We find that a simple modification-applying a head-specific sigmoid gate after the Scaled Dot-Product Attention (SDPA)-consistently improves performance.
  arXiv  Detail & Related papers  (2025-05-10T17:15:49Z)
• AnomalyGen: An Automated Semantic Log Sequence Generation Framework with LLM for Anomaly Detection [25.83270938475311]
  AnomalyGen is the first automated log synthesis framework specifically designed for anomaly detection.<n>Our framework integrates enhanced program analysis with Chain-of-Thought reasoning (CoT reasoning) to enable iterative log generation and anomaly annotation.<n>When augmenting benchmark datasets with synthesized logs, we observe maximum F1-score improvements of 3.7%.
  arXiv  Detail & Related papers  (2025-04-16T16:54:38Z)
• Ensemble-Enhanced Graph Autoencoder with GAT and Transformer-Based Encoders for Robust Fault Diagnosis [0.0]
  This study introduces a novel graph-based framework for fault classification.<n>It converts time-series vibration data from machinery operating at varying horsepower levels into a graph representation.<n>A Graph Auto (GAE) with a deep graph transformer encoder, decoder, and ensemble is developed to learn latent graph representations and classify faults.
  arXiv  Detail & Related papers  (2025-04-13T04:21:11Z)
• Learning sparse generalized linear models with binary outcomes via iterative hard thresholding [20.28503550819373]
  In statistics, generalized linear models (GLMs) are widely used for modeling data.<n>In this work, we propose to use and analyze an iterative hard thresholding (projected gradient descent on the ReLU loss) algorithm, called binary iterative hard thresholding (BIHT)<n>We establish that BIHT is statistically efficient and converges to the correct solution for parameter estimation in a general class of sparse binary GLMs.
  arXiv  Detail & Related papers  (2025-02-25T17:42:33Z)
• S*: Test Time Scaling for Code Generation [55.11863577956177]
  We propose S*, the first hybrid test-time scaling framework for code generation.<n>S* substantially improves the coverage and selection accuracy of generated code.
  arXiv  Detail & Related papers  (2025-02-20T09:18:53Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.