FLMLog: A Federated LLM Framework for Unified Online Log Anomaly Detection

Anomaly detection plays a pivotal role in ensuring the reliability of modern large-scale distributed systems. However, traditional log anomaly detection systems are centralized, which poses the risk of privacy leakage during data transmission. Previous research mainly focuses on single-domain logs,requiring domain-specific models and retraining, which limits flexibility and scalability. Significant advancements have been made by Large Language Models (LLMs) in the domains of natural language understanding and automated content creation. However,they still face persistent problems, including substantial computational costs and inadequate availability of training data. The combination of Federated Learning (FL) and LLMs (federated LLMs) offers a solution by leveraging distributed data while protecting privacy, which positions it as an ideal choice for sensitive domains. In this paper, we propose a unified online log anomaly detection framework, FLMLog, which is based on federated Learning and large language model. To enhance the operational efficiency, the FLMLog framework adopts a prefix-aware in-context learning (ICL) refinement strategy. This strategy is specifically designed to refine both the selection of in-context examples and the per-mutation order of these examples, thereby achieving an improvement in prefix caching efficiency. Our experiments demonstrate that the FLMLog framework is rigorously evaluated on five publicly available production log datasets, and the results show that it achieves superior comprehen-sive performance, outperforming state-of-the-art methods in F1-score on four out of five datasets with remarkable improvements.