A Multi-Source Log Hidden Anomaly Detection Method Integrating Trans-Encoder and LSTM

Identifying hidden anomalous behavior is a major challenge in anomaly detection, particularly in complex systems where anomalies are buried within massive log data and cannot be easily identified through simple patterns or rules. To address this issue, we propose a novel approach that integrates a Transformer encoder module with Long Short-Term Memory (LSTM) to detect covert anomalies in logs using only normal class datasets for training. First, we enhance feature extraction from multi-source log data by improving the Transformer encoder structure with an added masking mechanism. Then, we apply LSTM for time-series modeling to capture temporal correlations between extracted features, improving the model’s ability to analyze sequential dependencies. Finally, we evaluate the semantic and temporal consistency of operations to refine anomaly detection. Experimental results demonstrate that our approach effectively detects hidden anomalies, achieving improvements of 2.3% in precision, 4.9% in recall, and 3.4% in F1 score. Moreover, it maintains stable performance with just 10% of the training data and improves computational efficiency in the test phase by 16.98% compared to Deeplog, highlighting its potential for practical application in anomaly detection.