In recent years, with the continuous expansion of system scale, the amount of log data has been constantly increasing. However, quickly and accurately identifying a small number of abnormal patterns from massive, high-dimensional logs mixed with a large amount of irrelevant information remains the core challenge faced by log anomaly detection. There are many limitations to existing methods: static feature selection prevents the model from focusing on key features; lack of robustness to log format changes caused by system updates; supervised learning methods rely on a large number of manually annotated abnormal samples, while abnormal logs in real environments are scarce and annotation costs are high.

To address the above problems, the Cybersecurity Team of our center has proposed the LogAMF framework. This framework combines adaptive multi-feature fusion with self-supervised learning, introduces an attention based dynamic weight allocation mechanism, assigns dynamic weights to each feature, and highlights key features; By comprehensively learning the global distribution and local context of normal logs through two-stage tasks, anomaly detection can be completed by training only with normal logs, eliminating the dependence on a large number of annotated abnormal samples. Experiments on multiple public benchmark datasets have shown that LogAMF outperforms existing methods in terms of detection accuracy, recall and F1 score. It also demonstrates excellent robustness in log format perturbation scenarios, fully validating the practical value of this method in real complex environments.

This research achievement has been accepted by ICIC 2026, a recommended Class C conference by the China Computer Federation (CCF). The first author of the paper is Du Guanyao, the Department of Cybersecurity Technology and Application Development, and the corresponding author is Senior Engineer Long Chun. This work was jointly supported by National Key Researchand Development Program of China (2023YFC3304704) and Strategy Priority Research Program (Category A) of Chinese Academy of Sciences (XDA0460104).

System Architecture Diagram of the LogAMF Framework

Related Publication：G. Du, H. Chen, J. Zhao, Y. Wang, W. Wan, C. Long and Y. Wu, "LogAMF: Adaptive Multi-feature Fusion for Log Anomaly Detection" in 2026 International Conference on Intelligent Computing (ICIC), Toronto, Canada, 2026.