💻 computer science

LogSemFuse: Semantic Evidence Fusion for Explainable Log Anomaly Detection

LogSemFuse is an evidence-guided plug-in framework that enhances existing log anomaly detectors by fusing backbone predictions with reusable semantic evidence from local patterns, LLM reasoning, and executable rules to improve detection accuracy and provide actionable, explainable insights with minimal runtime overhead.

Original authors: Hassan Jabri, Zeyang Ma, Zhijie Wang, Tse-Hsun Chen

Published 2026-07-07

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Hassan Jabri, Zeyang Ma, Zhijie Wang, Tse-Hsun Chen

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a security guard for a massive, bustling city (a modern software system). Every day, millions of people (log messages) walk through the gates, shouting what they are doing. Your job is to spot the troublemakers (anomalies) before they cause a disaster.

For a long time, you've had a high-tech security camera system (existing AI detectors like DeepLog or LogBERT). This camera is great at counting faces and spotting patterns. If someone walks through the door 50 times in a minute, the camera screams, "ALARM!" But here's the problem: the camera only gives you a red light and a score. It doesn't tell you why it's alarmed. Is that person a thief? Are they just in a hurry? Did they trip? You have to stare at the raw video footage yourself to figure it out, which is slow and exhausting.

Recently, someone suggested hiring a super-smart detective (a Large Language Model, or LLM) to watch the video. This detective is great at understanding context and can tell you, "That person is running because they are stealing a bag." But there's a catch: hiring this detective for every single person walking through the gate is incredibly expensive and slow. Plus, sometimes the detective gets confused or makes up stories that aren't actually in the video.

Enter LogSemFuse.

The authors of this paper built a "plug-in" system that acts like a smart assistant for your existing security camera. It doesn't replace the camera; it just gives the camera a superpower: the ability to explain itself using evidence.

Here is how LogSemFuse works, using three simple tools:

1. The "Pattern Spotter" (Local Event Patterns)

Think of this as a list of "suspicious behaviors" you wrote down from past crimes.

How it works: The system looks at the raw data and finds short, specific sequences that always happen when something goes wrong. For example, "If someone tries to open a door, then immediately tries to break a window, then runs away," that's a bad pattern.
The Analogy: It's like having a cheat sheet that says, "If you see these three specific steps in a row, it's definitely a crime." This part is fast, free, and doesn't need the expensive detective.

2. The "Rule Book" (Cluster-Derived Rules)

Sometimes, crimes are more complex. They don't happen in a straight line; they happen in a messy group.

How it works: The system groups similar past crimes together (clustering) and asks the super-smart detective to write a "Rule Book" for each group. The detective says, "In this group of crimes, the bad guys always leave a note, but they never lock the back door." The system turns this into a strict rule.
The Analogy: Instead of asking the detective to watch every new person, you give the security guard a rule book: "If you see a note AND an unlocked back door, sound the alarm." The detective only writes the book once (during training), and the guard uses it forever.

3. The "On-Demand Detective" (LLM Reasoning)

What if a new, weird situation happens that isn't on your cheat sheet or in your rule book?

How it works: The system calls the super-smart detective only for that specific, confusing situation. The detective looks at the events, explains what's happening, and gives a confidence score. Crucially, the system saves this explanation. If that same weird situation happens again later, the system just pulls the saved explanation from its pocket instead of calling the detective again.
The Analogy: It's like calling a consultant for a unique problem, writing down their advice, and then filing it away so you never have to pay them for that same problem twice.

Putting It All Together

When a new "person" (log session) walks through the gate:

The Camera (the original AI) takes a look and gives a score.
The Pattern Spotter checks the cheat sheet.
The Rule Book checks the strict rules.
The On-Demand Detective is called only if the first three are unsure or if the situation is new.

All these pieces of evidence are combined. If any of them say "This looks bad," the system raises the alarm. But more importantly, it hands you a report that says: "We flagged this because: (1) They did the 'door-window-run' pattern, AND (2) They left a note but didn't lock the door, AND (3) The detective confirmed this looks like a theft."

Why is this a big deal?

The paper tested this on three different "cities" (datasets: HDFS, BGL, and Liberty) using four different security cameras.

Better Detection: It caught almost all the criminals the original cameras missed (recovering 98.8% of false negatives).
Better Explanations: When they asked human experts to read the explanations, they preferred LogSemFuse's reports over the detective's raw reports. The experts found LogSemFuse's explanations clearer, more logical, and better connected to the actual events.
Cheap and Fast: Because it reuses the cheat sheets and rule books, it doesn't need to call the expensive detective for every single person. It adds only a tiny, stable amount of time to the process.

In short: LogSemFuse takes a smart but silent security camera and gives it a voice, a notebook of rules, and a way to ask for help only when necessary. It makes the system smarter, faster, and much easier for humans to trust.

Technical Summary: LogSemFuse

Problem Statement

Log anomaly detection is essential for monitoring modern software systems, yet existing model-based detectors face two primary limitations. First, while they achieve strong detection performance, they typically output only anomaly scores or binary labels without providing the operational semantics behind the decision. This lack of evidence forces operators to manually inspect logs to understand why a session was flagged, hindering efficient diagnosis and incident response. Second, while Large Language Models (LLMs) can recover rich log semantics, using them as standalone detectors is often costly, prone to inference variability, and may not ground explanations in the specific evidence underlying a decision. Furthermore, directly prompting LLMs for every session is computationally expensive and difficult to scale.

The core challenge addressed is how to enhance existing, high-performing backbone detectors with interpretable semantic evidence and explanations without replacing their training pipelines or incurring prohibitive runtime costs.

Methodology: LogSemFuse Framework

LogSemFuse is proposed as a plug-in semantic augmentation framework. It does not replace the backbone detector or alter its training objective. Instead, it operates at the inference stage to fuse the backbone's prediction with structured semantic evidence derived from three distinct modules. The framework maintains a Knowledge Bank ( $K$ ) constructed during training, which stores reusable artifacts to minimize LLM usage during inference.

1. Training-Time Evidence Construction

Before inference, LogSemFuse processes the training data to build two types of reusable evidence:

Local Event-Pattern Bank ( $K_{ngram}$ ): The system mines discriminative unigrams, bigrams, and trigrams from EventId sequences in labeled anomalous training sessions. Patterns are ranked by "lift" (anomalous support relative to normal support) and validated to ensure they do not fire excessively on normal sessions. These patterns provide deterministic, interpretable evidence of short, contiguous anomalous behaviors (e.g., repeated retries or exception sequences).
Cluster-Derived Rule Bank ( $K_{rule}$ ): Anomalous training sessions are clustered using HDBSCAN based on their event distributions. For each cluster, an LLM is prompted to summarize the shared operational behavior and induce structured, executable rules. These rules use primitives such as contains_ngram, ordered_subset, min_count, and absent_within. The resulting rules capture broader, non-contiguous operational patterns and are stored for deterministic matching at inference time.

2. Inference-Time Semantic Augmentation

For an incoming log session $x$ , LogSemFuse aggregates four binary signals to produce a final decision and explanation:

Backbone Signal ( $s_b$ ): The original anomaly score or label from the backbone detector (e.g., DeepLog, LogBERT).
Local Pattern Signal ( $s_n$ ): Determined by matching the session's EventId sequence against $K_{ngram}$ .
Rule Signal ( $s_r$ ): Determined by executing the rules in $K_{rule}$ against the session.
LLM Semantic Reasoning Signal ( $s_\ell$ ): An LLM analyzes the session to provide a high-risk prediction, confidence score, and a rationale (expected vs. observed behavior). To control costs, the LLM is invoked only for new sessions; results are cached by session identifier for reuse.

Fusion and Explanation:
A fusion operator (selected from OR, AND, or vote- $k$ policies based on validation data) combines these four signals to determine the final anomaly label. The system then generates an evidence-based explanation by tracing the contributing signals: matched local patterns, triggered cluster-derived rules (with their cluster-level explanations), and the LLM's semantic rationale.

Key Contributions

The paper makes the following specific contributions:

Plug-in Framework: A method to enhance existing log detectors with executable semantic evidence without modifying their original training or inference pipelines.
Knowledge Bank Design: A mechanism to store reusable local event patterns and cluster-derived rules, alongside cached session-level LLM reasoning, enabling efficient, low-cost reuse.
Evidence-Based Explanation: An approach that explains anomaly decisions using fired patterns, triggered rules, and LLM rationales, rather than post-hoc feature attributions.
Empirical Validation: Comprehensive evaluation across three datasets (HDFS, BGL, Liberty) and four backbone detectors, demonstrating improved detection performance and explanation quality with modest overhead.

Evaluation Results

The framework was evaluated on HDFS, BGL, and Liberty datasets using DeepLog, LogAnomaly, LogBERT, and NeuralLog as backbones.

Detection Performance: LogSemFuse improved the F1-score for every non-perfect baseline. It recovered 98.8% of the backbone's false negatives across test sets. Notably, it preserved perfect performance in cases where the backbone was already optimal (e.g., LogAnomaly on Liberty).
Efficiency: The framework adds modest and stable inference-time overhead (ranging from ~2.3 to 5.8 seconds depending on the dataset) by relying on local pattern matching and rule execution rather than repeated LLM calls. LLM token usage is amortized through the reuse of cached results and the knowledge bank.
Human Evaluation: A user study with 14 participants (including developers and researchers) showed that LogSemFuse explanations were rated significantly higher than direct LLM explanations across all metrics (Logical Coherence, Technical Soundness, Clarity, etc.). LogSemFuse achieved a mean overall quality score of 4.13 compared to 3.06 for the baseline LLM.
Ablation Studies: Removing local event patterns caused the most significant performance degradation, indicating their critical role in detecting specific anomaly indicators. The cluster-derived rule bank provided reusable evidence for explanations, while LLM reasoning offered targeted gains in difficult configurations.

Significance and Claims

The paper claims that LogSemFuse demonstrates that semantic augmentation is a practical strategy to strengthen existing log anomaly detectors. By treating LLMs and rule induction as sources of reusable evidence rather than standalone detectors, the framework achieves:

Improved Effectiveness: Recovering missed anomalies that sequence-based models overlook due to sparse or diluted signals.
Interpretability: Providing operators with concrete, evidence-based explanations (patterns, rules, and rationales) rather than opaque scores.
Scalability: Maintaining low and stable runtime costs by caching semantic artifacts and avoiding per-session LLM inference for every request.

The authors position LogSemFuse not as a replacement for traditional detectors or a new LLM-centric paradigm, but as a unified method to bridge the gap between high-performance detection and actionable, semantic understanding in software reliability engineering.