基于协同Transformer的操作系统日志点异常与集体异常统一检测框架

A unified framework for detecting point and collective anomalies in operating system logs via collaborative transformers

December 29, 2025

作者: Mohammad Nasirzadeh, Jafar Tahmoresnezhad, Parviz Rashidi-Khazaee

cs.AI

摘要

日志异常检测对于维护操作系统安全至关重要。根据日志数据采集来源的不同，日志中记录的各种信息可视为不同的日志模态。基于这一认知，单模态方法往往因忽略日志数据的多模态特性而存在局限，而多模态方法又难以处理不同模态间的交互关系。受多模态情感分析的启发，我们提出CoLog框架，通过协同编码多种日志模态来实现异常检测。该框架采用协作式变换器和多头强化注意力机制学习多模态间的交互关系，确保异常检测的全面性。为处理模态交互导致的异质性，CoLog引入模态自适应层来适配不同日志模态的表征。这种方法使CoLog能够学习数据中细粒度的模式与依赖关系，从而提升异常检测能力。大量实验表明，CoLog在七项基准数据集上的综合检测性能优于现有最优方法，在点异常和集体异常检测中平均精确率达到99.63%，平均召回率99.59%，平均F1分数99.61%。CoLog全面的检测能力使其特别适用于网络安全、系统监控和运维效率提升场景。该框架通过统一架构为点异常和集体异常检测提供了先进的解决方案，有效应对自动日志数据分析面临的复杂挑战。CoLog实现代码已发布于https://github.com/NasirzadehMoh/CoLog。

English

Log anomaly detection is crucial for preserving the security of operating systems. Depending on the source of log data collection, various information is recorded in logs that can be considered log modalities. In light of this intuition, unimodal methods often struggle by ignoring the different modalities of log data. Meanwhile, multimodal methods fail to handle the interactions between these modalities. Applying multimodal sentiment analysis to log anomaly detection, we propose CoLog, a framework that collaboratively encodes logs utilizing various modalities. CoLog utilizes collaborative transformers and multi-head impressed attention to learn interactions among several modalities, ensuring comprehensive anomaly detection. To handle the heterogeneity caused by these interactions, CoLog incorporates a modality adaptation layer, which adapts the representations from different log modalities. This methodology enables CoLog to learn nuanced patterns and dependencies within the data, enhancing its anomaly detection capabilities. Extensive experiments demonstrate CoLog's superiority over existing state-of-the-art methods. Furthermore, in detecting both point and collective anomalies, CoLog achieves a mean precision of 99.63%, a mean recall of 99.59%, and a mean F1 score of 99.61% across seven benchmark datasets for log-based anomaly detection. The comprehensive detection capabilities of CoLog make it highly suitable for cybersecurity, system monitoring, and operational efficiency. CoLog represents a significant advancement in log anomaly detection, providing a sophisticated and effective solution to point and collective anomaly detection through a unified framework and a solution to the complex challenges automatic log data analysis poses. We also provide the implementation of CoLog at https://github.com/NasirzadehMoh/CoLog.