Krone: Hierarchical and Modular Log Anomaly Detection

Log anomaly detection is crucial for uncovering system failures and security risks. Although logs originate from nested component executions with clear boundaries, this structure is lost when stored as flat sequences. Hence, state-of-theart methods risk missing true dependencies within executions while learning spurious ones across unrelated events. We propose KRONE, the first hierarchical anomaly detection framework that automatically derives execution hierarchies from flat logs for modular multi-level anomaly detection. At its core, the KRONE Log Abstraction Model models log data by extracting the application-specific semantic hierarchical structure. This hierarchy is then leveraged by KRONE to recursively decompose log sequences into multi-levels of coherent execution chunks, i.e., KRONE Seqs, transforming sequence-level detection into a set of modular KRONE Seq-level detection tasks. For each test KRONE Seq, KRONE adopts a hybrid modular detection mechanism that routes between an efficient level-independent Local-Context detector that rapidly filters normal KRONE Seqs, and a Nested-Aware detector that incorporates cross-level semantic dependencies; augmented with LLM-based anomaly detection and explanation. KRONE optimizes the modular detection tasks along the hierarchy with cached result reuse and early-exit optimization strategies. Experiments on three public benchmarks and one industrial dataset from ByteDance Cloud demonstrate the comprehensive improvement of KRONE, on accuracy (42.49% → 87.98%), F-1 of same detector with or without hierarchy), dataefficiency (data space 117.3× ↓), resource-efficieny (43.7× ↓) and interpretability. KRONE improves F1-score by 10.07% (82.76% → 92.83%) over prior methods, while reducing LLM usage to 1.1%-3.3% of the test data size.