Abstract: System logs record the complete operational data of computer systems, and form the core foundation for system stability assurance, security guarantee and fault diagnosis. Existing graph-based log anomaly detection methods are incapable of extracting deep log semantics, mitigating class imbalance, modeling complex temporal dependencies, and providing intuitive anomaly interpretation simultaneously. This paper presents an anomaly detection scheme that integrates Large Language Model and dynamic graph networks. Based on the classic Graph Log Anomaly Detection framework, this paper incorporates semantic augmentation, data augmentation and multi-scale temporal graph modeling to propose LLM-GLAD, an LLM-driven log relational anomaly detection framework. An interpretable diagnosis module based on LLM is constructed to generate natural language anomaly explanations and root cause suggestions for practical deployment. Comparative experiments conducted on three public log datasets demonstrate that the proposed method achieves a precision of 96.45%, a recall of 93.43% and an F1-score of 94.92%.

Key words: log anomaly detection, graph neural network, large language model, data augmentation, semantic augmentation

摘要： 系统日志承载系统全量运行数据，是保障系统稳定安全运行、支撑故障排查工作的核心依据。针对现有基于图的日志异常检测方法存在难以挖掘日志深层语义、难以缓解样本类别不平衡、无法充分建模复杂时序关联、异常检测结果缺少直观解释的问题，本文对融合大语言模型（Large Language Model，LLM）与动态图网络的日志异常检测方案开展研究。本文依托经典图检测框架（Graph Log Anomaly Detection，GLAD），融合语义增强、数据增强与多尺度时序图建模策略，构建LLM驱动的日志关系异常检测框架LLM-GLAD，配套搭建LLM可解释诊断模块，可输出自然语言形式的异常说明与故障根因参考方案，提升模型落地实用价值。基于三组公开日志数据集开展多方法对比测试结果显示，该框架精确率、召回率、F1分数分别达到96.45%、93.43%、94.92%。

关键词: 日志异常检测, 图神经网络, 大语言模型, 数据增强, 语义增强