Knowledge-Augmented Log Anomaly Detection with Large Language Models

Log anomaly detection is critical for maintaining system reliability, yet existing large language model (LLM)-based methods suffer from limited accuracy, high computational costs, and poor explainability. In this paper, we introduce LogPipe, a novel framework that enhances LLM-based log anomaly detection by integrating a dynamic knowledge base. LogPipe constructs a knowledge base using discrete and semantic log patterns, augmented by dynamic patterns that are generated by a sentiment dictionary and frequent pattern mining. During inference, log sequences are matched against the knowledge base to provide specific guidance to the LLM, improving detection accuracy and generating detailed explanations. A continuous update mechanism ensures that the knowledge base remains relevant while minimizing redundant LLM queries, significantly reducing inference costs. Evaluated on eight public datasets, LogPipe achieves an average F1 score of 0.975, outperforming state-of-the-art models, with reduced token consumption. Additionally, LogPipe excels in fault localization, which enhances the explainability of detected anomalies.