基於協同轉換器的作業系統日誌點異常與集體異常統一偵測框架

A unified framework for detecting point and collective anomalies in operating system logs via collaborative transformers

December 29, 2025

作者: Mohammad Nasirzadeh, Jafar Tahmoresnezhad, Parviz Rashidi-Khazaee

cs.AI

摘要

日誌異常檢測對於維護作業系統安全至關重要。根據日誌資料收集來源的不同，各類被記錄的資訊可視為不同的日誌模態。基於此洞察，單模態方法常因忽略日誌資料的多模態特性而表現不佳，而多模態方法又未能有效處理模態間的互動關係。我們將多模態情感分析技術應用於日誌異常檢測，提出CoLog框架，該框架通過協同編碼機制整合多種日誌模態。CoLog採用協同轉換器與多頭加權注意力機制來學習多模態間的交互作用，確保實現全面的異常檢測。為處理模態交互產生的異質性問題，CoLog引入模態適應層來調整不同日誌模態的表徵。此方法使CoLog能學習數據中的細微模式與依賴關係，從而提升異常檢測能力。大量實驗證明CoLog在七個日誌異常檢測基準數據集上均優於現有最先進方法，在點異常和集體異常檢測中平均精確率達99.63%、平均召回率達99.59%、平均F1分數達99.61%。CoLog的全面檢測能力使其極適用於網路安全、系統監控和運維效率優化場景。該框架通過統一架構為點異常與集體異常檢測提供精準有效的解決方案，並成功應對自動化日誌資料分析中的複雜挑戰，標誌著日誌異常檢測領域的重大進展。我們已在https://github.com/NasirzadehMoh/CoLog開源CoLog的實現代碼。

English

Log anomaly detection is crucial for preserving the security of operating systems. Depending on the source of log data collection, various information is recorded in logs that can be considered log modalities. In light of this intuition, unimodal methods often struggle by ignoring the different modalities of log data. Meanwhile, multimodal methods fail to handle the interactions between these modalities. Applying multimodal sentiment analysis to log anomaly detection, we propose CoLog, a framework that collaboratively encodes logs utilizing various modalities. CoLog utilizes collaborative transformers and multi-head impressed attention to learn interactions among several modalities, ensuring comprehensive anomaly detection. To handle the heterogeneity caused by these interactions, CoLog incorporates a modality adaptation layer, which adapts the representations from different log modalities. This methodology enables CoLog to learn nuanced patterns and dependencies within the data, enhancing its anomaly detection capabilities. Extensive experiments demonstrate CoLog's superiority over existing state-of-the-art methods. Furthermore, in detecting both point and collective anomalies, CoLog achieves a mean precision of 99.63%, a mean recall of 99.59%, and a mean F1 score of 99.61% across seven benchmark datasets for log-based anomaly detection. The comprehensive detection capabilities of CoLog make it highly suitable for cybersecurity, system monitoring, and operational efficiency. CoLog represents a significant advancement in log anomaly detection, providing a sophisticated and effective solution to point and collective anomaly detection through a unified framework and a solution to the complex challenges automatic log data analysis poses. We also provide the implementation of CoLog at https://github.com/NasirzadehMoh/CoLog.