Smart Eye: LLM-Guided Proposer-Verifier Framework for Industrial-Scale Log Anomaly Detection

A practical log anomaly detection system for large-scale web services, suitable for real industrial deployment, should exhibit three key characteristics: fidelity to decisive lexical cues, human-auditable explanations, and low inference latency. Existing approaches often compromise one or more of these requirements by discarding crucial tokens during parsing, obscuring decisions through dense embeddings, or incurring heavy computational costs. We introduce Smart Eye, a deployable two-stage key pattern retrieval framework that employs large language models (LLMs) strictly as proposal engines, coupled with a deterministic verifier. In Stage I, the system enhances recall of anomalous logs under a configurable false positive budget using budgeted maximum coverage selection. In Stage II, precision is monotonically improved by refining parent patterns into specialized child patterns and introducing targeted exclusions. These essential patterns, extracted by LLMs and then confirmed, will be formulated into regular expressions to enable efficient online matching of anomalous logs. We provide both theoretical justification and a practical implementation that runs efficiently on commodity CPUs. When evaluated on three real world Huawei Cloud Core log datasets, Smart Eye achieves state-of-the-art anomaly detection with a average F1 score of 0.9877, outperforming the strongest neural baseline. Moreover, it produces human interpretable evidence chains and supports low latency inference. These results demonstrate that combining LLM-guided proposal generation with deterministic verification forms a robust and deployable alternative to traditional end to end embedding pipelines for industrial log analysis.