# MDFULog: Multi-Feature Deep Fusion of Unstable Log Anomaly Detection Model
## 1 Introduction  
With the development of Internet and computer technology, cloud computing, big data, Internet of Things, and other systems are expanding in size and complexity, system maintenance is becoming more difficult, and anomalies become unavoidable [1]. A minor problem in the system can lead to performance degradation, data corruption, or even a significant loss of customers and revenue. Therefore, for the development and maintenance personnel of a system or software, ensuring its stable and reliable operation and reducing the number and scope of exceptions are their primary objectives [2]. Modern systems often produce many log files during operation. Systems running on medium networks can easily exceed TBs [3] daily. The logs reflect the running state of the system and record activity information for specific events in the system. Logs are a valuable resource for understanding the state of your system. Therefore, system logs are an important data source for performance monitoring and anomaly detection. The sheer volume and variety of log data make it more difficult for operational engineers to rely on simple keyword searches or regular matching for manual analysis. Although researchers have proposed many solutions for log anomaly detection, the following problems remain:  
1. Standard log parsers frequently generate more noise when detecting log exceptions, resulting in ambiguous parsing. The system log is generally noisy, and understanding the subjectivity of operators takes much work. Normal noise logs are easilymisinterpreted as abnormal. The uncertainty of log module updating makes dynamic adaptation to log changes difficult for the detection model. The traditional classification-based deep learning method can effectively solve the problem of static log exception detection. However, when dealing with dynamically unstable data, performance suffers significantly due to conceptual drift and noise. 2. The current anomaly detection method separately trains the corresponding learning models for the different features of the log (e.g., time anomalies, parameter anomalies, etc.) while ignoring the correlation between the different features of the log. Even some methods usually handle only a single exception type. To effectively identify log-related logical and time exceptions, they need to be better at mining complicated and changeable log feature information. As a result, detection accuracy is impacted when feature correlation analysis and feature fusion capability are neglected. 3. Current studies have primarily used variants of RNNs, led by LSTM, to detect anomalies in log data. However, capturing information recursively only obtains historical sequences, not long series dependencies, and internal relationships cannot be learned globally. However, in recent years, the popular Transformer's ability to learn from a global perspective can effectively handle long-sequence problems. However, the computational cost is high, and the running speed is slow. A global, low-cost, and fast algorithm is urgently needed to solve the problem of log anomaly detection. This paper proposes a novel multi-feature deep fusion of an unstable log anomaly detection model (MDFULog) to address the above problems. In order to have more sophisticated log parsing, the authors propose a novel token-based log parsing method to extract log templates without losing log information. The semantic information in the template is represented vectorially by [PERSON] based on contrastive learning, which can ensure the robustness of the newly input template. Furthermore, the temporal information is projected into the high-dimensional embedding, considering various log anomalies. The suggested Informer-based classification model for anomaly detection reduces memory occupation and enhances attention perception. The proposal was evaluated using the real open-source datasets HDFS, OpenStack, and our synthetic unstable log dataset. The contributions of this article can be summarized as follows:  
1.