TY - GEN
T1 - Semantic Curriculum for Anomaly Detection
T2 - 2026 IEEE Conference on Computer Communications, INFOCOM 2026
AU - Tan, Kai
AU - Du, Yangliu
AU - Zhan, Dongyang
AU - Yu, Haining
AU - Liu, Hao
AU - Yu, Zhaofeng
AU - Zhang, Wenqi
N1 - Publisher Copyright:
© 2026 IEEE.
PY - 2026
Y1 - 2026
N2 - System logs are central to diagnosing failures and monitoring behavior in complex software systems. Yet their unstructured format, semantic variability, and distributional shifts across systems make anomaly detection particularly challenging. Traditional methods - based on templates, static features, or rule-based matching - struggle to generalize, especially in low-label or cross-system scenarios. Large language models (LLMs) offer strong semantic understanding and can infer latent behavioral patterns from raw log text, while meta-learning enables fast adaptation to new tasks with few labels. To harness these complementary strengths, we propose a novel meta-learning framework that formulates log anomaly detection as a language-guided task induction problem. Rather than using LLMs as predictors or encoders, we employ them as semantic agents that decompose log data into structured meta-tasks and inform the adaptation of the meta-learner to new system environments. This synergy enables accurate and transferable anomaly detection across heterogeneous system environments, without requiring system-specific heuristics or extensive retraining. Experiments on diverse system log benchmarks demonstrate substantial gains in detection accuracy and robustness under distribution shift. To our knowledge, this is the first work to systematically integrate LLMs for task semantic modeling with meta-learning in system log anomaly detection, marking a shift toward generalizable, language-informed detection paradigms.
AB - System logs are central to diagnosing failures and monitoring behavior in complex software systems. Yet their unstructured format, semantic variability, and distributional shifts across systems make anomaly detection particularly challenging. Traditional methods - based on templates, static features, or rule-based matching - struggle to generalize, especially in low-label or cross-system scenarios. Large language models (LLMs) offer strong semantic understanding and can infer latent behavioral patterns from raw log text, while meta-learning enables fast adaptation to new tasks with few labels. To harness these complementary strengths, we propose a novel meta-learning framework that formulates log anomaly detection as a language-guided task induction problem. Rather than using LLMs as predictors or encoders, we employ them as semantic agents that decompose log data into structured meta-tasks and inform the adaptation of the meta-learner to new system environments. This synergy enables accurate and transferable anomaly detection across heterogeneous system environments, without requiring system-specific heuristics or extensive retraining. Experiments on diverse system log benchmarks demonstrate substantial gains in detection accuracy and robustness under distribution shift. To our knowledge, this is the first work to systematically integrate LLMs for task semantic modeling with meta-learning in system log anomaly detection, marking a shift toward generalizable, language-informed detection paradigms.
KW - LLM
KW - anomaly detection
KW - cross-system
KW - log analysis
KW - meta learning
UR - https://www.scopus.com/pages/publications/105044569970
U2 - 10.1109/INFOCOM59046.2026.11571687
DO - 10.1109/INFOCOM59046.2026.11571687
M3 - 会议稿件
AN - SCOPUS:105044569970
T3 - Proceedings - IEEE INFOCOM
BT - INFOCOM 2026 - IEEE Conference on Computer Communications
PB - Institute of Electrical and Electronics Engineers Inc.
Y2 - 18 May 2026 through 21 May 2026
ER -