A unified framework for detecting point and collective anomalies in operating system logs via collaborative transformers
Mohammad Nasirzadeh, Jafar Tahmoresnezhad, Parviz Rashidi-Khazaee
2026-01-01
Summary
This paper introduces CoLog, a new system designed to better detect unusual activity in computer logs, which is important for keeping systems secure.
What's the problem?
Currently, systems that try to automatically find problems in computer logs often struggle because logs come in different 'types' or 'modalities' – think of them as different kinds of information. Some systems only look at one type of log, missing important clues, while others try to combine types but don't understand how they relate to each other, leading to missed or false alarms.
What's the solution?
CoLog tackles this by using a special type of artificial intelligence called 'transformers' that are designed to work *together* on all the different log types. It also uses something called 'impressed attention' to figure out how the different log types influence each other. Because these log types are naturally different, CoLog includes a 'modality adaptation layer' to make sure everything is understood consistently. Essentially, it learns to see the bigger picture by understanding how all the pieces fit together.
Why it matters?
This is a big deal because CoLog is significantly better at finding both single, isolated problems and groups of related problems in computer logs than existing methods. With very high accuracy rates – almost 99.6% on key tests – it can help improve cybersecurity, make system monitoring more reliable, and generally make computer systems run more efficiently. It provides a more complete and effective way to automatically analyze log data.
Abstract
Log anomaly detection is crucial for preserving the security of operating systems. Depending on the source of log data collection, various information is recorded in logs that can be considered log modalities. In light of this intuition, unimodal methods often struggle by ignoring the different modalities of log data. Meanwhile, multimodal methods fail to handle the interactions between these modalities. Applying multimodal sentiment analysis to log anomaly detection, we propose CoLog, a framework that collaboratively encodes logs utilizing various modalities. CoLog utilizes collaborative transformers and multi-head impressed attention to learn interactions among several modalities, ensuring comprehensive anomaly detection. To handle the heterogeneity caused by these interactions, CoLog incorporates a modality adaptation layer, which adapts the representations from different log modalities. This methodology enables CoLog to learn nuanced patterns and dependencies within the data, enhancing its anomaly detection capabilities. Extensive experiments demonstrate CoLog's superiority over existing state-of-the-art methods. Furthermore, in detecting both point and collective anomalies, CoLog achieves a mean precision of 99.63%, a mean recall of 99.59%, and a mean F1 score of 99.61% across seven benchmark datasets for log-based anomaly detection. The comprehensive detection capabilities of CoLog make it highly suitable for cybersecurity, system monitoring, and operational efficiency. CoLog represents a significant advancement in log anomaly detection, providing a sophisticated and effective solution to point and collective anomaly detection through a unified framework and a solution to the complex challenges automatic log data analysis poses. We also provide the implementation of CoLog at https://github.com/NasirzadehMoh/CoLog.