LogDWG: Dynamic Window Graph-based Log Anomaly Detection with Dual-Modal Graph Convolution

Abstract

Log anomaly detection is crucial for enhancing the reliability and security of computer systems. Existing methods for mining temporal and relational patterns in logs often exhibit deficiencies. To address these issues, this paper proposes LogDWG, a novel log anomaly detection method based on Dynamic Window Graphs. LogDWG employs a dynamic window segmentation algorithm to adaptively adjust log grouping sizes. It integrates the BERT model to generate semantic embeddings of logs and constructs directed heterogeneous graphs to capture both temporal and relational features between log events. Experimental results demonstrate that LogDWG significantly outperforms traditional methods, such as PCA and SVM, as well as existing deep learning models, such as DeepLog and GLAM. On multiple public datasets, including BGL and HDFS, LogDWG achieves improvements in F1-score of up to 3.6%, validating its effectiveness and accuracy in anomaly detection. The key innovations of this work include the dynamic window grouping strategy, the fusion of log semantics with temporal features, and the design of a dual-modal graph convolutional network.