| 引用本文： |
-
陈奕任,朱燕,李文韬,姜波,卢志刚,刘宝旭,刘祺远.基于多智能体共识的日志异常检测[J].信息安全学报,已采用 [点击复制]
- chenyiren,zhuyan,liwentao,jiangbo,luzhigang,liubaoxu,liuqiyuan.Log Anomaly Detection based on Multi-agent Consensus[J].Journal of Cyber Security,Accept [点击复制]
|
|
| 摘要: |
| 随着网络威胁日益复杂，基于深度学习的日志异常检测方法暴露出过度依赖训练数据、泛化能力弱与可解释性不足等缺陷。近年来，大语言模型(LLM)缓解了传统方法的部分问题，但仍面临提示词敏感、解释分析不稳定等挑战。同时，已有研究较少考虑数据投毒、模型偏见等LLM内生安全问题对检测效果的影响。在此背景下，本文提出了一种基于多智能体共识的日志异常检测方法。首先，本文通过监督微调和数据蒸馏，训练了多个快照的本地日志大模型。然后，本文使用教师模型对学生模型进行二次监督，通过融合两个模型对分类结果的信任分数，划分出黑、白、灰三种日志。最后，本文针对灰日志构建了多模型协同推理框架，引导多个大模型进行知识共享和隐式博弈，以降低大模型幻觉和单模型缺陷引发的负面影响。同时，本文使用不同解释的语义相似度来控制提示词模板，确保多智能体辩论更快收敛，形成高度对齐的结果解释。在BGL和HDFS两个数据集上，本文方法分别取得了0.876和0.958的F1分数，并在模糊样本检测、跨数据源检测、数据投毒等场景中存在显著优势。此外，本文首次将大模型输出的“自然语言解释”视为一类可被迭代利用的检测资源，并构建了其反向优化异常日志检测的可行路径。本文也贡献了一种基于语义相似度反馈的多智能体辩论框架，它可能在模糊样本分类任务中存在应用潜力。 |
| 关键词: 日志异常检测 模糊样本检测 可解释性分析 多智能体辩论 |
| DOI： |
| 投稿时间：2025-06-04修订日期：2025-07-28 |
| 基金项目:国家重点研发计划（No.2023YFC2206402）；中国科学院战略重点研究计划（No.XDA0460100） |
|
| Log Anomaly Detection based on Multi-agent Consensus |
|
chenyiren1, zhuyan1, liwentao1, jiangbo1, luzhigang1, liubaoxu1, liuqiyuan2
|
| (1.No. 9 Research Office, Institute of Information Engineering, Chinese Academy of Sciences;2.Tsinghua Shenzhen International Graduate School) |
| Abstract: |
| As cyber threats become more complex, log anomaly detection based on deep learning methods has revealed critical limitations, including overreliance on training data, poor generalization capability, and insufficient interpretability. In recent research, large language model (LLM) has tackled some of such issues, but challenges exist for its sensitivity to prompts and unstable quality of explanatory analysis. Moreover, existing studies rarely consider the risks of LLM, such as data poisoning and model algorithm bias, which visibly affect practical detection performance. In light of this, this paper proposes a multi-agent consensus framework for log anomaly detection. First of all, some snapshot versions of local LLMs are trained via supervised fine-tuning and data distillation. After that, the consensus process between the teacher model and the student model is introduced, where the trust scores from both models are used to classify logs into three types: benign, anomalous, and ambiguous ("black", "white", and "gray" logs). In the end, we design an improved multi-agent debate mechanism for detecting gray logs, which enables knowledge sharing and implicit negotiation among three agents, thereby mitigating the hallucination of LLM and overcoming the weaknesses of a single LLM. At the same time, the semantic similarity between the explanations from different agents is used to guide the selection of prompt templates, as well as accelerate multi-agent debate convergence. The result of experiments on the BGL dataset and HDFS dataset shows that the proposed method achieves F1-scores of 0.893 and 0.972, respectively, outperforming baselines under various conditions such as fuzzy samples detection, cross data source detection, and adversarial corruption. Notably, this work is the first to regard the textual explanation of labels as reusable resources for iterative detection. It also presents a novel framework of multi-agent debate based on the semantic similarity of output, which may hold potential in fuzzy sample classification. |
| Key words: Log anomaly detection Fuzzy sample detection Interpretability analysis Multi-agent game |
