# Scalable and Adaptive Log-based Anomaly Detection with Expert in the Loop

**Authors:** Jinyang Liu, Junjie Huang, Yintong Huo, Zhihan Jiang, Jiazhen Gu, Zhuangbin Chen, Cong Feng, Minzhi Yan, Michael R. Lyu  
**arXiv:** [2306.05032](https://arxiv.org/abs/2306.05032)  
**Date:** 2023-06-08  
**Summary page:** https://www.summarizepaper.com/en/arxiv-id/2306.05032v1/

## Key points

- System logs are essential for maintaining reliability in software systems
- SeaLog is a novel approach characterized by accuracy, lightweight nature, and adaptability in detecting anomalies within logs
- SeaLog utilizes the Trie-based Detection Agent (TDA) for real-time anomaly detection, which can receive feedback from experts to enhance accuracy
- Contemporary large language models like ChatGPT can offer feedback with a consistency level comparable to human experts, reducing manual verification efforts significantly
- SeaLog outperforms baseline methods in terms of effectiveness, operating 2X to 10X faster and consuming only 5% to 41% of memory resources

## Summary

, , , , 

In the realm of software systems, system logs are essential for maintaining reliability. Various studies have delved into automatic log-based anomaly detection and have achieved commendable accuracy on standardized datasets. However, when these solutions are applied to large-scale cloud systems, they encounter challenges such as high resource consumption and a lack of adaptability to evolving logs. To address these limitations, a novel approach called SeaLog has been introduced in this paper. SeaLog is characterized by its accuracy, lightweight nature, and adaptability in detecting anomalies within logs. At the core of SeaLog lies the Trie-based Detection Agent (TDA), which utilizes a dynamically-growing trie structure for real-time anomaly detection. What sets TDA apart is its ability to receive feedback from experts, thereby enhancing its accuracy in response to changing log data. Notably, the study reveals that contemporary large language models like ChatGPT can offer feedback with a consistency level comparable to human experts, potentially reducing manual verification efforts significantly. The effectiveness of SeaLog was extensively evaluated using two public datasets and an industrial dataset. The results showcased SeaLog's superiority over all baseline methods in terms of effectiveness. Moreover, SeaLog operates 2X to 10X faster than existing solutions and consumes only 5% to 41% of the memory resources required by traditional methods. This highlights the potential of SeaLog as a scalable and adaptive framework for log-based anomaly detection in complex software systems.