Systems and method for anomaly detection pipeline with few-shot language models

A system, comprising:

• a plurality of network devices in a computer network, each network device generating a log-text comprising status information for the network device;
• a database comprising a plurality of log-text examples, each log-text example comprising a label, wherein each label indicates if the log-text example is anomalous or not anomalous;
• and
• an electronic device executing an anomaly detection computer program that is configured to receive the plurality of log-text examples;
• to identify, from the plurality of log-text examples and labels, rules for weak annotation, and validation labels for a validation dataset and test labels for a test dataset;
• to organize the plurality of log-text examples in the validation dataset into a plurality of time windows;
• to concatenate the plurality of log-text examples in each time window;
• to provide the concatenated log-text examples and the rules for weak annotation to a weak annotation framework to obtain a large language model (LLM) training dataset;
• to train a LLM with the LLM training dataset;
• to collect a plurality of runtime log-texts from the network devices for a period of time;
• to concatenate the runtime log-texts for the period of time;
• to prompt the LLM for analysis with the concatenated log-texts, wherein the LLM outputs a response of anomaly or no anomaly and a confidence in the response;
• and to re-route network traffic away from one of the network devices based on the response indicating an anomaly with the network device.

A non-transitory computer readable storage medium, including instructions stored thereon, which when read and executed by one or more computer processors, cause the one or more computer processors to perform steps comprising:

• receiving a plurality of log-text examples from network devices and labels for each of the log-text examples, wherein each label indicates if the log-text example is anomalous or not anomalous;
• identifying, from the plurality of log-text examples and labels, rules for weak annotation, and validation labels for a validation dataset and test labels for a test dataset;
• organizing the plurality of log-text examples in the validation dataset into a plurality of time windows;
• concatenating the plurality of log-text examples in each time window;
• providing the concatenated log-text examples and the rules for weak annotation to a weak annotation framework to obtain a large language model (LLM) training dataset;
• training a LLM with the LLM training dataset;
• collecting a plurality of runtime log-texts from the network devices for a period of time;
• concatenating the runtime log-texts for the period of time;
• prompting the LLM for analysis with the concatenated log-texts, wherein the LLM outputs a response of anomaly or no anomaly and a confidence in the response;
• and re-routing network traffic away from one of the network devices based on the response indicating an anomaly with the network device.