摘要： 现有日志异常检测技术在语义建模中往往忽略时间上下文信息，模态融合能力不足，并且普遍过度依赖日志解析，这些局限使模型难以捕捉语义内容突变与时间行为异常并存的复杂模式。为解决上述挑战，本文提出了一种无日志解析的端到端检测模型（Log Spatio-Temporal Fusion，LogSTF）。该模型采用语义与时间双分支结构，语义分支获取上下文感知的语义特征，时间分支以时间级与序列级的双粒度建模同时捕捉局部突发与全局演化的时间模式；在此基础上，通过跨模态的双向交叉注意力实现模态融合，显式建立语义与时间之间的细粒度依赖，从而提升对复杂日志行为的建模与判别能力。在HDFS、BGL和Thunderbird三个公开日志数据集上进行实验，结果表明LogSTF在三个数据集上的F1值分别达到99.64%、98.45%和99.67%，与最新的两个基准模型LAnoBERT和LogFormer相比，F1值平均相对提升5.20%和2.03%，通过消融实验验证了时间信息与模态协同对性能提升的关键作用。基于轻量语义扰动下的鲁棒性测试，验证了LogSTF在非理想日志条件下的稳健性与泛化表现。该方法在无需日志解析的前提下，实现了对复合型异常模式的高精度识别。

Abstract: Existing log anomaly detection techniques often neglect temporal contextual information in semantic modeling, exhibit insufficient modality fusion capabilities, and generally over-rely on log parsing. These limitations make it difficult for models to capture complex patterns where sudden semantic content changes coexist with temporal behavioral anomalies. To address these challenges, this paper proposes a model that operates without log parsing (Log Spatio-Temporal Fusion, LogSTF). This model employs a dual-branch architecture for semantic and temporal processing. The semantic branch extracts context-aware semantic features, while the temporal branch models both local bursts and global evolution through dual-granularity at temporal and sequence levels. Building upon this foundation, bidirectional cross-attention achieves modal fusion, explicitly establishing fine-grained dependencies between semantics and time. This enhances the model’s ability to represent and discern complex log behaviors. Experiments conducted on three public log datasets—HDFS, BGL, and Thunderbird— results show LogSTF achieves F1 scores of 99.64%, 98.45%, and 99.67% respectively across the three datasets. Compared to the two state-of-the-art models LAnoBERT and LogFormer, LogSTF demonstrates average relative F1 improvements of 5.20% and 2.03%. Ablation experiments validate the critical role of temporal information and modality collaboration in performance enhancement. Robustness testing under lightweight semantic perturbations validated LogSTF’s stability and generalization capabilities under suboptimal log conditions. This approach achieves high-precision detection of complex anomaly patterns without requiring log parsing.