Beyond Window-Based Detection: A Graph-Centric Framework for Discrete Log Anomaly Detection

TL;DR

The paper addresses anomaly detection in discrete event logs, where traditional window-based methods struggle with context bias and fuzzy localization. It introduces TempoLog, a window-free, graph-centric framework that constructs continuous-time dynamic graphs from logs, with log templates as nodes and temporal relations as edges, and employs multi-scale temporal graph networks plus a semantic-aware module to capture local and global dependencies. Key contributions include the continuous-time dynamic-graph construction, a multi-scale GNN architecture, and a semantic-aware detection component. Empirical results on public datasets demonstrate state-of-the-art event-level anomaly detection performance and significant gains in accuracy and efficiency over existing approaches, highlighting the method's practical impact for reliable and scalable log analysis.

Abstract

Detecting anomalies in discrete event logs is critical for ensuring system reliability, security, and efficiency. Traditional window-based methods for log anomaly detection often suffer from context bias and fuzzy localization, which hinder their ability to precisely and efficiently identify anomalies. To address these challenges, we propose a graph-centric framework, TempoLog, which leverages multi-scale temporal graph networks for discrete log anomaly detection. Unlike conventional methods, TempoLog constructs continuous-time dynamic graphs directly from event logs, eliminating the need for fixed-size window grouping. By representing log templates as nodes and their temporal relationships as edges, the framework dynamically captures both local and global dependencies across multiple temporal scales. Additionally, a semantic-aware model enhances detection by incorporating rich contextual information. Extensive experiments on public datasets demonstrate that our method achieves state-of-the-art performance in event-level anomaly detection, significantly outperforming existing approaches in both accuracy and efficiency.