一句话：提出免解析的 MoE 日志异常检测框架 LogMoE，利用多系统日志训练轻量专家并门控集成，实现跨系统泛化。
系统日志异常检测对软件稳定运行至关重要，但现有方法依赖大量标注数据、日志解析和预定义模板，难以适应跨系统的格式演变与分布偏移。作者提出 LogMoE：一种可扩展且免解析的日志异常检测框架。它利用多个成熟系统的标注日志训练轻量专家模型，并通过门控机制集成到 Mixture-of-Experts 架构，从而泛化到未见目标系统；免解析设计使其对日志格式与句法异质性更鲁棒。在八个日志数据集上，作者在单系统、同构系统和异构系统场景下评估，结果显示 LogMoE 持续稳健泛化，尤其在目标系统标注数据稀缺时表现突出，为复杂演化软件环境提供了可扩展方案。
Robust anomaly detection in system logs plays a crucial role in maintaining stable and reliable software operations. However, existing methods often struggle to accommodate evolving log formats and distributional shifts across systems, as they heavily rely on large volumes of labeled data, log parsing, and predefined event templates. To address these challenges, we propose LogMoE, a scalable and parsing-free log anomaly detection framework. LogMoE utilizes labeled logs from multiple mature systems to train a set of lightweight expert models, which are integrated via a gating mechanism within a Mixture-of-Experts (MoE) architecture. This design enables LogMoE to generalize effectively to previously unseen target systems. By eliminating the need for log parsing, our approach remains robust against the heterogeneity of log formats and syntactic structures. We conduct extensive evaluations on eight log datasets under varying generalization scenarios: single-system, homogeneous-system, and heterogeneous-system. Experimental results demonstrate that LogMoE consistently achieves robust generalization, particularly under conditions with scarce labeled data in the target system. As such, LogMoE provides a scalable, parsing-free, and generalization-capable solution tailored for complex and continuously evolving software system environments, positioning it as a future-ready approach to log anomaly detection.
DOI 原文 ·
@inproceedings{paperbot9573,
title = {LogMoE: Lightweight Expert Mixture for Cross-System Log Anomaly Detection},
author = {Jiaxing Qi and Zhongzhi Luan and Shaohan Huang and Carol Fung and Yuchen Wang and Aibin Wang and Hongyu Zhang and Hailong Yang and Depei Qian},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00035}
}