LogSemFuse: Semantic Evidence Fusion for Explainable Log Anomaly Detection

Abstract

Log anomaly detection is critical for reliability monitoring and failure diagnosis in modern software systems. Existing model-based detectors provide useful anomaly signals, but they can still miss anomalous sessions and typically expose only scores or labels rather than the operational semantics behind a decision. This lack of semantic evidence limits their ability to explain why a session is anomalous, even when the final anomaly label is correct. The gap matters in practice because operators need to distinguish urgent failures from benign deviations and trace suspicious sessions back to concrete operational behavior. LLMs can recover richer log semantics, but using them as standalone detectors or repeatedly generating free-form explanations can be costly and difficult to reuse. We present LogSemFuse, an evidence-guided plug-in framework that enhances existing backbone detectors without replacing their original pipelines. LogSemFuse combines backbone predictions with reusable semantic evidence from local event patterns, LLM-based semantic reasoning, and cluster-derived executable rules to produce both anomaly decisions and evidence-based explanations. The resulting output reports the final label together with the semantic evidence that supports it, such as fired local patterns, triggered rules, and LLM rationale. We evaluate LogSemFuse on HDFS, BGL, and Liberty using DeepLog, LogAnomaly, LogBERT, and NeuralLog as backbones. LogSemFuse improves every non-perfect baseline, preserves the already perfect case, recovers 98.8% of backbone false negatives, and produces explanations preferred over direct LLM explanations in a human study. These gains require only modest and stable inference-time overhead, showing that semantic augmentation can improve detection effectiveness and interpretability without imposing large runtime costs.