Open Access

ARTICLE

Explainable Anomaly Detection for System Logs in Distributed Environments

Zhaojun Gu¹, Wenlong Yue², Chunbo Liu^1,*

Information Security Evaluation Center, Civil Aviation University of China, Tianjin, China
College of Computer and Artificial Intelligence, Civil Aviation University of China, Tianjin, China

* Corresponding Author: Chunbo Liu. Email:

Computers, Materials & Continua 2026, 87(3), 94 https://doi.org/10.32604/cmc.2026.077388

Received 08 December 2025; Accepted 28 February 2026; Issue published 09 April 2026

Abstract

Anomaly detection in system logs is a critical technical means for identifying potential faults and security risks. In distributed environments, traditional deep learning-based log anomaly detection methods often suffer from shortcomings in transparency, computational overhead, and data privacy protection. To address these issues, this paper proposes a federated learning-driven lightweight and explainable log anomaly detection framework named FedXLog. The framework adapts to heterogeneous logs through hierarchical feature extraction, introduces the Federated Gradient Trajectory Aggregation algorithm (FedGradTrace) to enhance the explainability of the parameter aggregation process, constructs lightweight models using knowledge distillation, and achieves globally consistent explanatory capabilities by integrating hash feature alignment. Experimental results demonstrate that FedXLog possesses the dual advantages of high detection accuracy and lightweight deployment for heterogeneous logs in distributed scenarios. It can effectively identify key decision-making features and locate typical root causes of anomalies. Notably, the framework has been specifically optimized for the unique characteristics of distributed logs. Distinguished from general federated explainable methods, it can directly support abnormal root cause localization in Operations and Maintenance scenarios. This further verifies the application value of scenario-specific adaptation of federated learning in the field of log analysis, thereby expanding the scope of application of explainable log anomaly detection.

---

Keywords

---