用动态图网络分析日志事件，精准定位异常。
Beyond Window-Based Detection: A Graph-Centric Framework for Discrete Log Anomaly Detection
- 构建连续时间动态图，无需固定窗口划分。
- 在多个时间尺度上捕捉局部与全局依赖关系。
- 适合需要高精度异常检测的系统运维场景。
离散事件日志中的异常检测对保障系统可靠性、安全性和效率至关重要。传统基于窗口的方法常因上下文偏差和定位模糊而难以精确高效地识别异常。为此，我们提出一种图中心框架TempoLog，利用多尺度时序图网络进行离散日志异常检测。与传统方法不同，TempoLog直接从日志事件构建连续时间动态图，无需固定大小的时间窗口分组。通过将日志模板表示为节点，其时间关系表示为边，该框架能动态捕捉跨多个时间尺度的局部与全局依赖。此外，语义感知模型通过引入丰富上下文信息进一步提升检测效果。在多个公开数据集上的大量实验表明，该方法在事件级异常检测上达到当前最优性能，显著优于现有方法，在准确率和效率方面均有明显提升。
原文摘要 · Abstract (English)
Detecting anomalies in discrete event logs is critical for ensuring system reliability, security, and efficiency. Traditional window-based methods for log anomaly detection often suffer from context bias and fuzzy localization, which hinder their ability to precisely and efficiently identify anomalies. To address these challenges, we propose a graph-centric framework, TempoLog, which leverages multi-scale temporal graph networks for discrete log anomaly detection. Unlike conventional methods, TempoLog constructs continuous-time dynamic graphs directly from event logs, eliminating the need for fixed-size window grouping. By representing log templates as nodes and their temporal relationships as edges, the framework dynamically captures both local and global dependencies across multiple temporal scales. Additionally, a semantic-aware model enhances detection by incorporating rich contextual information. Extensive experiments on public datasets demonstrate that our method achieves state-of-the-art performance in event-level anomaly detection, significantly outperforming existing approaches in both accuracy and efficiency.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。