LogCDM detects log anomalies on CPU with an 8M-parameter model
Original title: LogCDM: Interpretable Log Anomaly Detection via Behavioral Graph Drift and Adaptive Signal Fusion
It reports F1 of 0.984 on HDFS and scores a session in 5.5-10.5 ms without a GPU.
LogCDM is a compact log-anomaly detector that fuses next-event surprise from a small causal Transformer, distance between a session transition-graph embedding and a normal reference graph, and a transition-drift statistic described as a frequency-weighted chi-squared divergence. A sigmoid gate combines the three signals and, under the authors' Gaussian model, corresponds to a Bayes posterior. With 8.1-8.8M parameters and CPU-only inference, the authors report F1 scores close to an 8.1B-parameter LLM detector on HDFS, BGL, and Thunderbird.
Unconfirmed: F1 gaps versus the 8.1B detector are the authors' results under their evaluation protocol.
- Reported F1 is 0.984 on HDFS, 0.870 on chronological BGL, and 0.850 on Thunderbird.
- Those scores are within 0.013-0.12 of an 8.1B-parameter LLM detector under the same protocol.
- Structural signals add 0.025-0.030 F1 on BGL and Thunderbird but almost nothing on HDFS.
- Inference needs no GPU and takes 5.5-10.5 ms per session on a CPU.
From the original article
1 min read at arxiv.orgLog-based anomaly detection is increasingly dominated by large pretrained models, from BERT-scale encoders to 8B-parameter language models, which require GPUs at inference time and are difficult to deploy on the monitoring nodes where logs are produced.
By Suryansh Talukdar · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.