LogAD-SWFMF: An Unsupervised Log Anomaly Detection Model Based on Static Weighted Fusion of Multi-Features

Addressing the issues of single feature representation and inefficient dynamic fusion in anomaly detection tasks within large-scale log analysis scenarios, this paper proposes an unsupervised log anomaly detection model based on static weighted fusion of multi-features (LogAD-SWFMF). This model comprises two components: a data preprocessing module and a deep learning module. The data preprocessing module employs a multi-dimensional feature extraction strategy, transforming raw logs into three distinct types of features: sequence features, statistical features, and semantic features. The deep learning module is designed to independently capture the inherent patterns of various features, and it has a three-channel LSTM-FC (Long Short Term Memory Network - Fully Connected layer) network structure, establishing parallel learning paths for temporal dependency modeling, frequency statistical analysis, and semantic space mapping. During the feature fusion phase, the model employs a static weighted mechanism. It constructs learnable weight factors and utilizes the softmax function to normalize these weights. Subsequently, it performs a weighted fusion of the multi-modal feature learning results. This approach effectively balances the contributions of different features. Comparative experimental results on the HDFS dataset show that LogAD-SWFMF attains an F1 score of 97.8%, which represents improvements of 3.6% and 2.1% over the DeepLog and LogAnomaly models, respectively. Moreover, through in - depth ablation experiments, it has been further confirmed that the incorporation of normalized static weighted fusion can enhance the model's performance in log anomaly detection, fully illustrating the feasibility and effectiveness of the proposed model.