A generalizable BERT-GNN hybrid framework for unified log anomaly detection

Abstract

Logs are essential for monitoring large-scale distributed systems, yet their volume and structural heterogeneity pose substantial challenges for automated analysis. Conventional approaches often struggle to jointly model semantic information and temporal dependencies, which limits feature generalization across diverse environments. We propose Log2graphs, a generalizable framework for unified, unsupervised log analysis. Its core component, the Multi-Graph Autoencoder (MGAE), integrates Bidirectional Encoder Representations from Transformers (BERT) with a Graph Neural Network (GNN). Within MGAE, BERT extracts contextual semantic embeddings from raw log messages, while the GNN captures the chronological and topological correlations among log events. By reconstructing complex multi-graph structures, MGAE transforms sequential dependencies into low-dimensional representations without relying on labeled data. Experiments on widely used benchmark datasets, such as HDFS and BGL, show that the features extracted by MGAE improve downstream anomaly detection performance, outperforming baselines including LogFiT and LogFormer with F1 score gains of up to 11%. To extend benchmark validation to real-world settings with limited labeled datasets (e.g., HPC, Proxifier, and Zookeeper), we introduce a rigorous evaluation strategy using three domain-adaptive, label-free clustering metrics: Silhouette Score, Davies-Bouldin Index, and Calinski-Harabasz Index. This strategy enables quantitative assessment of the learned feature space in unsupervised environments and reduces reliance on ground-truth logs.