AnomalyGen: Enhancing Log-Based Anomaly Detection with Code-Guided Data Augmentation

TL;DR

AnomalyGen is a framework that enhances log-based anomaly detection by synthesizing realistic log sequences using static analysis and large language models, significantly improving detection performance.

Contribution

It introduces a novel data augmentation method combining static analysis and LLM reasoning to generate labeled log sequences for better anomaly detection.

Findings

Deep learning models improved F1-score by over 2% on HDFS and Zookeeper.

Unsupervised Transformer's F1-score increased from 0.818 to 0.970 on HDFS.

Both static analysis and LLM verification are essential for effective augmentation.

Abstract

Log-based anomaly detection is fundamentally constrained by training data sparsity. Our empirical study reveals that public benchmark datasets cover less than 10% of source code log templates. Consequently, models frequently misclassify unseen but valid execution paths as anomalies, leading to false alarms. To address this, we propose AnomalyGen, a novel framework that augments training data by synthesizing labeled log sequences from source code. AnomalyGen combines log-oriented static analysis with Large Language Model (LLM) reasoning in three stages: (1) building Log-Oriented Control Flow Graphs (LCFGs) to enumerate structurally valid execution paths; (2) applying LLM Chain-of-Thought (CoT) reasoning to verify logical consistency and generate realistic runtime parameters (e.g., block IDs, IP addresses); and (3) labeling generated sequences with domain heuristics. Evaluations on HDFS and Zookeeper across 12 diverse anomaly detection models show AnomalyGen consistently improves performance. Deep learning models achieved average F1-score gains of 2.18% (HDFS) and 1.69% (Zookeeper), with an unsupervised Transformer on HDFS jumping from 0.818 to 0.970. Ablation results show that both static analysis and LLM-based verification are necessary: removing them reduces F1 by up to 8.7 and 10.7 percentage points, respectively. Our framework and datasets are publicly available to facilitate future research.