CLSLog: Collaborating Large and Small Models for Log-based Anomaly Detection

As software systems become more complex, ensuring reliability through log-based anomaly detection presents significant challenges, particularly when dealing with evolutionary logs generated during software evolution. While small deep learning models (SM) have been employed for log anomaly detection, they struggle with handling evolutionary logs that deviate from the training distribution. On the other hand, large language models (LLMs) show great potential in leveraging the rich semantic information in logs but suffer from inefficiencies and lack domain-specific knowledge. To address these challenges, we propose CLSLog, a collaborative scheme that leverages the generalization capabilities of LLMs and the efficiency and low-cost advantages of small models. We model log anomaly detection as a semantic similarity binary classification task to enable collaboration between small and large models at the semantic understanding level. The small model accelerates the detection process by providing reliable results for non-evolutionary logs, while for evolutionary logs, the small model's predictions and intermediate results help enhance the LLM with domain-specific knowledge. Preliminary experimental results on two open dataseys demonstrate that this combined approach outperforms using either model individually, achieving higher accuracy and reducing detection time and costs.