CloudAnoAgent: Neuro-Symbolic Cloud Detector

• CloudAnoAgent is a neuro-symbolic, multimodal anomaly detection agent that integrates real-time metrics and contextual logs with symbolic verification to improve accuracy.
• It employs a fast/slow detection pipeline that analyzes metrics in real-time and triggers log analysis for contextual anomaly verification.
• Evaluations on CloudAnoBench demonstrate significant gains in anomaly classification accuracy and a marked reduction in false positives compared to traditional methods.

Searching arXiv for CloudAnoAgent and closely related cloud-agent papers. CloudAnoAgent is a neuro-symbolic LLM-based agent for anomaly detection in cloud environments that jointly processes structured metrics and textual log data in a unified pipeline, uses symbolic verification to validate detection hypotheses, and generates structured anomaly reports. It was introduced together with CloudAnoBench, a benchmark with paired metrics and logs and fine-grained anomaly behavior annotations, as a response to the high false positive rates of metric-only cloud anomaly detectors and the operational burden those false alarms impose on Site Reliability Engineers (Zou et al., 3 Aug 2025).

1. Problem domain and motivation

CloudAnoAgent is situated in the setting of cloud-site anomaly detection over multimodal telemetry. The target signals are structured metrics such as CPU, GPU, memory, disk I/O, and network throughput, together with unstructured logs containing terminal-style events about job execution, configuration changes, user actions, and service messages. The paper frames this setting as difficult because cloud environments are large, dynamic, heterogeneous, and highly coupled: services auto-scale, migrate, or terminate; workloads shift continuously; and normal operational events can resemble anomalous behavior in raw telemetry (Zou et al., 3 Aug 2025).

The central technical claim is that metric-only methods are intrinsically brittle in this regime. Thresholding, clustering, statistical tests, and metric-centric ML models inspect only numerical time series and therefore miss contextual explanations that are often only visible in logs. A sudden GPU spike, for example, can be consistent with an attack or with a legitimate deep learning job launch. When anomaly labels are rare and normality is dominant, such ambiguity produces high false positive rates. In operational terms, the consequence is alert fatigue, reduced trust in monitoring systems, and additional investigation cost for SRE teams.

CloudAnoAgent addresses this ambiguity by treating anomaly detection as a multimodal reasoning problem rather than a pure time-series classification problem. The system does not merely append logs to metrics; it organizes detection into staged reasoning over metrics, logs, and explicit verification, with the stated goals of improving accuracy, reducing false positives, and increasing interpretability.

2. Unified metrics–logs detection pipeline

The architecture is organized around a Fast and Slow Detector. Fast Detection is a real-time metrics agent that continuously monitors time-series signals in a fixed sliding window. It searches for five canonical anomaly patterns consolidated from prior time-series anomaly literature: Spike, Dip, Gradual Increase, Gradual Decrease, and Fluctuation. Its output is a structured report stating whether an anomaly is detected, which metric or metrics are affected, and the anomaly pattern type (Zou et al., 3 Aug 2025).

Slow Detection is an event-driven log agent that is triggered when the metrics agent flags a potential anomaly. This second stage examines the temporally aligned log window and reasons about whether the metric deviation is genuinely abnormal or benign, the likely root cause, and the higher-level anomaly category. The log agent assigns a categorical anomaly possibility level of low, medium, or high. A final decision-maker then fuses metric and log evidence to produce the final anomaly-versus-normal decision, anomaly type classification, and a natural-language explanation.

This staged organization is important because it is not a simple late-fusion ensemble. The workflow is explicitly sequential: detect a candidate anomaly from metrics, inspect logs for contextual support, validate and refine the hypothesis, and then emit a structured diagnosis. The paper argues that this decomposition is what allows the system to retain real-time responsiveness in the metric stream while using logs to disambiguate benign metric excursions from true faults. It also underlies the paper’s broader claim that architecture matters, not just the choice of LLM backbone.

3. Neuro-symbolic verification and report generation

A defining feature of CloudAnoAgent is its neuro-symbolic mechanism. The neural component is the LLM-agent reasoning in Fast and Slow Detection. The symbolic component is a Symbolic Verifier that checks whether the agent’s predicted anomaly hypothesis is consistent with explicit rules. The paper motivates this by noting that LLM outputs are stochastic; symbolic verification is therefore intended to improve both reliability and interpretability (Zou et al., 3 Aug 2025).

The verifier has two main parts. The first is a metric rule checker, which evaluates whether the observed numerical behavior matches the expected signature of a predefined anomaly type using rules involving thresholds, averages, and temporal volatility. The second is a log pattern matcher, which uses regex-based keyword detection to test whether the log evidence is semantically consistent with the predicted anomaly category. For each anomaly type, the verifier therefore requires support from both modalities.

The paper’s Algorithm 1, “Symbolic Verification and Critic Loop,” formalizes this logic. If the detector claims anomaly $(a, t)$, the system accepts the hypothesis only when both VerifyMetric(M, t) and VerifyLog(L, t) succeed; otherwise, the final decision-maker retests based on the failed answers. If the detector predicts normal, the verifier still checks every possible anomaly type, and if both metric and log verification pass for some type, the final decision-maker retests again. The loop either returns a consistent decision or abstains after a maximum number of attempts. This mechanism means that the system does not blindly trust the LLM’s first answer; it requires explicit cross-modal consistency before final acceptance.

CloudAnoAgent also includes a Report Agent. Rather than producing a raw alert, the Report Agent assembles detector and verifier outputs into an SRE-oriented report containing an anomaly summary, the causal reasoning process, the inferred root cause, and prioritized remediation suggestions. The paper treats this reporting layer as part of the system’s interpretability claim: the output is meant to support operational diagnosis, not merely binary alarm generation.

4. CloudAnoBench and anomaly taxonomy

CloudAnoAgent is evaluated on CloudAnoBench, introduced as the first benchmark to jointly provide aligned metrics, aligned logs, and fine-grained anomaly annotations. The benchmark is designed to fill a gap left by datasets such as LO2 and SMD, which do not provide the paired log context needed to evaluate false positives and causal reasoning. CloudAnoBench contains 49 manually curated cases, comprising 19 labeled anomaly cases and 30 labeled normal cases, with 10 anomaly types and two difficulty levels, easy and difficult (Zou et al., 3 Aug 2025).

The 10 anomaly types and their characteristic paired patterns are summarized below.

Anomaly type	Characteristic paired pattern
mine	CPU spike + xmrig download/execution via CRON
oom	memory gradual rise + GC failure + OOM kill logs
gpu_hijack	GPU spike + deep learning job run from unknown container
port_scan	network fluctuation + repeated port connection attempts
icmp_flood_dos	network-in spike + ICMP echo request bursts
dns_amplification	network-out spike + excessive DNS queries to open resolvers
data_exfiltration	network-out gradual increase + outbound scp/curl
arp_spoofing	intermittent net instability + ARP reply storm
log_storm	disk I/O spike + burst of crawler logs from unknown IPs
log_growth_anomaly	gradual disk growth + large scheduled backup writes

The benchmark is generated through an LLM-driven simulation approach intended to mimic realistic cloud behavior. Each case includes multivariate time-series metrics collected in a fixed window using automated top-based scripts and terminal-style logs generated by LLMs to simulate system events. The logs are temporally aligned with the metric sequence, do not explicitly restate metric values, and are mixed with benign unrelated entries such as SSH logins or suspended scheduled tasks to simulate noise. Easy cases are shorter, typically single-metric, and have concise logs; difficult cases are longer, may involve multiple anomalous metrics, and contain more distracting log content. This benchmark design makes false-positive resistance and anomaly-type reasoning directly measurable rather than incidental.

5. Evaluation methodology and empirical findings

The empirical study is organized around four research questions: whether CloudAnoAgent outperforms baselines, what symbolic verification contributes, how strong the interpretability and explanation quality are, and how performance varies across LLM backbones. The baselines include a traditional rule-based method, RuleEnsembleAD; traditional machine-learning methods including Isolation Forest, Decision Tree, Logistic Regression, K-Means, Rarity Model, and OOV Detector; and an LLM baseline in which metrics and logs are directly fed into the model without agent decomposition or symbolic verification. The primary metrics are ACA, Anomaly Classification Accuracy, and ATCA, Anomaly Type Classification Accuracy. Experiments were run with API-accessed LLMs under default vendor inference settings, repeated three times per LLM and averaged, on a cluster with two NVIDIA A100 GPUs (Zou et al., 3 Aug 2025).

The main quantitative results are reported at the level of average improvements. CloudAnoAgent improves overall ACA by 46.36% over traditional baselines and by 36.67% over the LLM baseline on average. It reduces false positive rate by 36.67% over traditional baselines and by 33.89% over the LLM baseline on average. The paper emphasizes an important pattern behind these averages: traditional baselines often perform well either on anomaly cases or on normal cases, but not both, while the vanilla LLM baseline detects anomalies fairly well yet performs much worse on normal cases, indicating high false positives. CloudAnoAgent is reported as strong on both anomaly and normal cases.

The symbolic verifier contributes materially to those gains. When added to CloudAnoAgent, it improves overall ACA by 10.65% and reduces false positive rate by 17.04%. On ATCA, CloudAnoAgent outperforms the vanilla LLM baseline by 12.8% overall, and the symbolic verifier improves ATCA by 4.97% in ablation. The difficult subset is especially revealing: relative to the LLM baseline, CloudAnoAgent achieves a 27.78% gain in ACA and a 33.61% gain in ATCA on difficult cases. The paper interprets these results as evidence that simply prompting an LLM with metrics and logs is insufficient; the gains arise from fast/slow task decomposition, explicit verification, and structured hypothesis refinement rather than from model scale alone.

6. Scope, interpretation, and relation to broader cloud-agent research

CloudAnoAgent is best understood as an anomaly-detection and structured-diagnosis agent rather than a general cloud-operations platform. A common misconception is that it is equivalent to vanilla prompting over concatenated metrics and logs. The reported ablations and baseline comparisons reject that interpretation: the system’s performance depends on the fast/slow detector split, the symbolic critic loop, and the report-generation stage, not merely on multimodal input concatenation (Zou et al., 3 Aug 2025).

A second misconception is that CloudAnoAgent is a closed-loop remediation system. Compared with STRATUS, which is an LLM-based multi-agent system for autonomous SRE with specialized detection, diagnosis, mitigation, and undo agents organized in a state machine, CloudAnoAgent stops at anomaly decision, anomaly typing, explanation, and remediation suggestion rather than direct state mutation (Chen et al., 27 May 2025). This suggests that CloudAnoAgent occupies the anomaly-detection and diagnosis segment of a broader cloud-agent stack, while systems such as STRATUS target failure mitigation.

The same distinction appears when CloudAnoAgent is compared with broader CloudOps frameworks. MOYA is a multi-agent framework for autonomous CloudOps that emphasizes orchestration across heterogeneous data sources, RAG-grounded specialization, and bounded autonomy with human oversight (Parthasarathy et al., 14 Jan 2025). The position study on cloud infrastructure management argues that effective cloud agents must also choose among SDK, CLI, IaC, and web portals depending on task type, and that guardrails, rollback, and state synchronization are central design concerns (Yang et al., 13 Jun 2025). In relation to those systems, CloudAnoAgent is narrower but deeper in one function: multimodal anomaly detection with explicit symbolic validation.

CloudAnoBench likewise requires careful interpretation. It is explicitly an LLM-driven simulation benchmark with temporally aligned paired metrics and logs rather than a direct dump of production telemetry. This implies that the reported improvements are strongest as evidence about multimodal anomaly reasoning under controlled, fine-grained annotations. A plausible implication is that the benchmark is especially valuable for evaluating false-positive behavior and anomaly-type discrimination, while deployment in enterprise cloud environments will still depend on how well the paired metric–log abstractions transfer to operational data sources.

Within the emerging literature on cloud agents, CloudAnoAgent’s distinctive contribution is therefore not general orchestration, elastic scaling, trust management, or remediation execution. Its contribution is the claim that cloud anomaly detection becomes materially more reliable when numerical telemetry is paired with contextual logs and when LLM outputs are constrained by symbolic verification. In that sense, it provides a specialized neuro-symbolic detection layer that can complement broader cloud-agent systems concerned with scheduling, reliability engineering, or full-stack CloudOps automation.