Search papers, labs, and topics across Lattice.
This paper introduces AnomalyGen, a code-guided data augmentation framework to address training data sparsity in log-based anomaly detection. AnomalyGen leverages static analysis to build Log-Oriented Control Flow Graphs and uses LLM Chain-of-Thought reasoning to generate realistic and logically consistent runtime parameters for synthetic log sequences. Experiments on HDFS and Zookeeper datasets demonstrate that AnomalyGen consistently improves the F1-score of 12 diverse anomaly detection models, with particularly significant gains for unsupervised Transformer models.
Log-based anomaly detection models are missing 90% of the picture, but AnomalyGen uses LLMs and static analysis to hallucinate realistic training data and close the gap.
Log-based anomaly detection is fundamentally constrained by training data sparsity. Our empirical study reveals that public benchmark datasets cover less than 10% of source code log templates. Consequently, models frequently misclassify unseen but valid execution paths as anomalies, leading to false alarms. To address this, we propose AnomalyGen, a novel framework that augments training data by synthesizing labeled log sequences from source code. AnomalyGen combines log-oriented static analysis with Large Language Model (LLM) reasoning in three stages: (1) building Log-Oriented Control Flow Graphs (LCFGs) to enumerate structurally valid execution paths; (2) applying LLM Chain-of-Thought (CoT) reasoning to verify logical consistency and generate realistic runtime parameters (e.g., block IDs, IP addresses); and (3) labeling generated sequences with domain heuristics. Evaluations on HDFS and Zookeeper across 12 diverse anomaly detection models show AnomalyGen consistently improves performance. Deep learning models achieved average F1-score gains of 2.18% (HDFS) and 1.69% (Zookeeper), with an unsupervised Transformer on HDFS jumping from 0.818 to 0.970. Ablation results show that both static analysis and LLM-based verification are necessary: removing them reduces F1 by up to 8.7 and 10.7 percentage points, respectively. Our framework and datasets are publicly available to facilitate future research.
