Systems and method for anomaly detection pipeline with few-shot language models

Abstract

A method may include: receiving a plurality of log-text examples from network devices and labels indicating if the log-text example is anomalous or not anomalous; identifying, from the log-text examples and labels, rules for weak annotation, and validation labels for a validation dataset and test labels for a test dataset; organizing log-text examples in the validation dataset into a plurality of time windows; concatenating log-text examples in each time window; providing the concatenated log-text examples and the rules for weak annotation to a weak annotation framework, to a LLM training dataset; training a LLM with the LLM training dataset; collecting runtime log-texts from the network devices for a period of time; concatenating the runtime log-texts for the period of time; and prompting the LLM for analysis with the concatenated log-texts, wherein the LLM outputs a response of anomaly or no anomaly and a confidence in the response.