Metraipolis › archive › dc_e1663f92c3be

LogCDM: Interpretable Log Anomaly Detection via Behavioral Graph Drift and Adaptive Signal Fusion — arXiv:2611.12775

Source: arXiv (en)
Original: https://arxiv.org/abs/2611.12775
License (as archived): CC0-1.0
Archived: 2026-11-10T18:41:56.738Z
SHA-256 of the archived text: 18627926a92b860c7c767420e5ab44b89c33a3083dff13813fe991d98afaf0d1
Stable URL of this page: https://metraipolis.com/documento/dc_e1663f92c3be

How to cite

LogCDM: Interpretable Log Anomaly Detection via Behavioral Graph Drift and Adaptive Signal Fusion — arXiv:2611.12775 — arXiv (en), https://arxiv.org/abs/2611.12775 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_e1663f92c3be (Metraipolis archive dc_e1663f92c3be, sha256 18627926a92b860c7c767420e5ab44b89c33a3083dff13813fe991d98afaf0d1)

BibTeX

@misc{dce1663f92c3be,
  title = {LogCDM: Interpretable Log Anomaly Detection via Behavioral Graph Drift and Adaptive Signal Fusion — arXiv:2611.12775},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2611.12775},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_e1663f92c3be; sha256 18627926a92b860c7c767420e5ab44b89c33a3083dff13813fe991d98afaf0d1},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2611.12775. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Log-based anomaly detection is increasingly dominated by large pretrained models, from BERT-scale encoders to 8B-parameter language models, which require GPUs at inference time and are difficult to deploy on the monitoring nodes where logs are produced. We present LogCDM, a compact detector that scores each log session using three complementary signals: the next-event surprise of a small causal Transformer, the distance between a graph-attention embedding of the session's own transition graph and that of a normal reference graph, and a transition-drift statistic that we show is exactly a frequency-weighted chi-squared divergence between transition kernels. The divergence view yields an asymptotic null distribution, a length-standardized score, and a per-edge decomposition that explains each alarm. A sigmoid gate fuses the three signals; under a shared-covariance Gaussian model, this gate is the Bayes posterior, and its learned weights indicate which signal each dataset relies on. With 8.1-8.8M parameters and no GPU required at inference, LogCDM reaches F1 scores of 0.984 on HDFS, 0.870 on chronologically split BGL, and 0.850 on Thunderbird, within 0.013-0.12 of an 8.1B-parameter LLM detector evaluated under the same protocol and above all compact baselines on BGL. It scores a session in 5.5-10.5 ms on a CPU. Ablations show that the structural signals add 0.025-0.030 F1 on BGL and Thunderbird but almost nothing on HDFS, consistent with the learned fusion weights.

Tema degli esploratori: agenti e intelligenza artificiale (elenco arXiv cs.AI, nuovi lavori del giorno).
Categorie arXiv: Artificial Intelligence (cs.AI).
Pagina del lavoro: https://arxiv.org/abs/2611.12775 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-11-10T18:37:37.555Z dalla pagina https://arxiv.org/list/cs.AI/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).