ADALog: Adaptive Unsupervised Anomaly detection in Logs with Self-attention Masked Language Model

Modern software systems generate extensive heterogeneous log data with dynamic formats, fragmented event sequences, and varying temporal patterns, making anomaly detection both crucial and challenging. To address these complexities, we propose ADALog, an adaptive, unsupervised anomaly detection framework designed for practical applicability across diverse real-world environments. Unlike traditional methods reliant on log parsing, strict sequence dependencies, or labeled data, ADALog operates on individual unstructured logs, extracts intra-log contextual relationships, and performs adaptive thresholding on normal data. The proposed approach utilizes transformer-based, pretrained bidirectional encoder with masked language modeling task, fine-tuned on normal logs, to capture domain-specific syntactic and semantic patterns essential for accurate anomaly detection in complex environments. Anomalies are identified via token-level reconstruction probabilities, aggregated into log-level scores, with an adaptive percentile-based thresholding, calibrated only on normal data. Through this approach, the model dynamically adapts to evolving system behaviors, contributing to generalization while eliminating the rigidity of heuristic-based thresholds, often utilized in traditional anomaly detection systems. ADALog is systematically evaluated on commonly used log benchmark datasets, BGL, Thunderbird, and Spirit, demonstrating both superior performance and generalization capabilities. While the proposed approach is distinct and not directly comparable, it is outperforming or matching state-of-the-art supervised, self-supervised, and unsupervised log anomaly detection methods, used for reference. We perform comprehensive ablation studies to delve into evaluation of masking strategies, fine-tuning, and token position analysis, impacting model’s decision boundaries to enhance both detection performance and model interpretability. ADALog’s sequence-agnostic, adaptive, and unsupervised approach enables a scalable, resilient, and practical anomaly detection solution, supporting diverse applications across modern software ecosystems, from cloud infrastructures to on-premises computing environments.