MPFM: Cross Multi-Domain Prototype Flow Matching for Log Anomaly Detection

Cross multi-domain log anomaly detection aims to train a unified model applying in multiple heterogeneous systems, alleviating the annotation cost and scalability bottlenecks of traditional cross single-domain approaches. However, existing methods face two fundamental challenges: (i) geometric proximity alone is insufficient to certify normality, and (ii) forcibly aligning distributions across domains can induce negative transfer. To address these issues, we propose MPFM (Cross Multi-Domain Prototype Flow Matching for Log Anomaly Detection), grounded in the principle that anomalies are samples that cannot be stably generated by the normal data-generating mechanism. Specifically, MPFM employs a shared–private prototype system to disentangle cross-domain commonalities from domain-specific patterns, introduces domain-conditioned flow matching to perform anomaly detection by integrating structural and dynamical evidence, and further leverages prototype-drift-driven hard example mining to improve robustness near decision boundaries. Experiments on HDFS, BGL, Thunderbird, and Spirit demonstrate that MPFM delivers substantial gains under multi-domain joint training.

Modern computer systems produce large numbers of logs that record what happens inside servers and applications. These logs help engineers find failures, but collecting labeled examples for every system is expensive, and a model trained for one system may not work well on another. This paper proposes MPFM, a method that learns from several systems at the same time while keeping track of both common normal patterns and system-specific behavior. Instead of judging a log only by how close it looks to previous normal examples, the method also asks whether the log can be consistently explained by the learned normal behavior of its system. This helps reduce false alarms when systems differ and improves the detection of hard-to-classify unusual events. Experiments on four public log datasets show that MPFM improves multi-system anomaly detection, which can make large-scale software operations more reliable and easier to maintain.