A Mathematical Modeling Framework for Semantic–Temporal Graph Learning in Log Anomaly Detection
- 1School of Management Engineering, Capital University of Economics and Business, Beijing 100070, China
- 2School of System Science and Statistics, Beijing Wuzi University, Beijing 101149, China
Abstract
System logs provide valuable information for monitoring system states, identifying failures, and detecting anomalous behaviour in large-scale distributed computing systems. However, their unstructured text, complex semantic dependencies, temporal variation, and severe class imbalance limit conventional methods based on event templates, sequence statistics, or shallow features. To address these challenges, this study proposes a unified mathematical modelling framework for log anomaly detection, instantiated as the Conditional Graph Attention Transformer for Log Analysis (CGATLog). The framework represents temporally ordered log observations as a weighted attributed graph and jointly models semantic representations, event dependencies, temporal associations, and minority-class distributions. A BERT-Transformer encoder first extracts contextual semantic representations from log entries. A weighted log graph is then constructed from event-transition relationships, semantic similarity, and temporal proximity. To alleviate anomaly scarcity, anomalous node representations are generated in the graph embedding space and connected to the original graph through a learnable edge-relation predictor. A semantic–temporal gated graph attention mechanism further regulates the contributions of semantic and temporal associations during neighbourhood aggregation. Experiments on HDFS, BGL, and Thunderbird show that CGATLog achieves competitive log anomaly detection performance. The results also confirm that semantic–temporal graph modelling and anomaly sample augmentation improve robustness, particularly under severe class imbalance.
Related
- Transformer-aided guard: A hybrid spatio-temporal framework for confidence-aware intrusion detection in cyber-physical systems
- GT-PSSM: Unified Probabilistic Framework for Stochastic Dynamics Modeling and Dependency Learning in Multivariate Time Series Anomaly Detection
- Semantic Similarity‐Informed Bayesian Borrowing for Quantitative Signal Detection of Adverse Events
- Coupled Usage-Sense Processes: Temporal and Attributable Lexical Semantic Change
- Mathematical modeling, simulation and optimization via (port-Hamiltonian) differential-algebraic equations
BibTeX
@article{gao2026mathematical,
title = {{A Mathematical Modeling Framework for Semantic–Temporal Graph Learning in Log Anomaly Detection}},
author = {Shuo Gao and Xiaoyan Wang},
journal = {Mathematics},
year = {2026},
month = oct,
doi = {10.3390/math14213866},
url = {https://www.mdpi.com/2227-7390/14/21/3866},
note = {CC BY 4.0},
}
RIS
TY - JOUR
TI - A Mathematical Modeling Framework for Semantic–Temporal Graph Learning in Log Anomaly Detection
AU - Shuo Gao
AU - Xiaoyan Wang
PY - 2026
DA - 2026/10/23
JO - Mathematics
DO - 10.3390/math14213866
UR - https://www.mdpi.com/2227-7390/14/21/3866
AB - System logs provide valuable information for monitoring system states, identifying failures, and detecting anomalous behaviour in large-scale distributed computing systems. However, their unstructured text, complex semantic dependencies, temporal variation, and severe class imbalance limit conventional methods based on event templates, sequence statistics, or shallow features. To address these challenges, this study proposes a unified mathematical modelling framework for log anomaly detection, instantiated as the Conditional Graph Attention Transformer for Log Analysis (CGATLog). The framework represents temporally ordered log observations as a weighted attributed graph and jointly models semantic representations, event dependencies, temporal associations, and minority-class distributions. A BERT-Transformer encoder first extracts contextual semantic representations from log entries. A weighted log graph is then constructed from event-transition relationships, semantic similarity, and temporal proximity. To alleviate anomaly scarcity, anomalous node representations are generated in the graph embedding space and connected to the original graph through a learnable edge-relation predictor. A semantic–temporal gated graph attention mechanism further regulates the contributions of semantic and temporal associations during neighbourhood aggregation. Experiments on HDFS, BGL, and Thunderbird show that CGATLog achieves competitive log anomaly detection performance. The results also confirm that semantic–temporal graph modelling and anomaly sample augmentation improve robustness, particularly under severe class imbalance.
SN - 2227-7390
ER -