DyLogNet: a dynamic multi-relational graph framework for log anomaly detection

Web-scale platforms and online services rely on log-based anomaly detection to safeguard availability, latency SLOs, and user experience. In real-world web interactions, system logs often exhibit irregular temporal intervals, bursty densities, and heterogeneous semantics, which pose significant challenges for log anomaly detection. Existing methods such as LSTM and Transformer assume a fixed input window, which conflicts with the inherently irregular nature of system logs. Moreover, most prior works build a single-view representation, overlooking the multi-relational nature of logs. To overcome these challenges, we propose DyLogNet, a dynamic multi-relational graph framework for log anomaly detection. Specifically, this framework constructs a density-aware dynamic graph with variable-length windows, and represents logs from three relational perspectives: temporal co-occurrence, semantic similarity, and anomaly tendency. Next, we design a cross-layer attention mechanism that integrates heterogeneous structures to highlight the most relevant relations and enhance event representations. Furthermore, a cross-snapshot memory injection module updates global memory through a recurrent unit and injects it into current graph representations via an affine transformation, enabling temporal continuity. Experiments on three public log datasets demonstrate that DyLogNet outperforms state-of-the-art methods, especially in few-shot scenarios.