Aggregation of multimodal log and metric streams for neuro-fuzzy anomaly detection in computer systems

Ensuring the stable and reliable operation of modern computer systems is a critical challenge. This is typically achieved through the continuous logging of system events and the monitoring of hardware resource metrics (e.g., CPU, RAM). However, conventional monitoring solutions generally analyse these data streams in isolation. Their direct integration is significantly hindered by fundamental differences in their temporal characteristics and measurement scales. For instance, logs are often processed using OpenSearch, while metrics are monitored via Grafana. Consequently, the correlation context is lost, which impedes the identification of the root causes of system anomalies. To overcome these limitations, this paper proposes a novel method that fuses the multimodal input streams of logs and metrics into a unified feature space, specifically designed for subsequent use by neuro-fuzzy systems for advanced anomaly detection. This study presents a mathematical formalization of the problem domain by introducing a unified system of variables and developing an observation space model. The proposed heterogeneous data aggregation method effectively prepares the input space for neuro-fuzzy classifiers. Temporal synchronization between metrics and events is achieved through a sliding window strategy, while min-max normalization is applied to numerical indicators to eliminate feature dominance. Additionally, log processing is implemented by converting unstructured messages into standardized templates, which are then weighted by their criticality level and further analysed using the entropy of the event stream. The proposed approach generates an informative state space characterized by high spatial separability between normal and anomalous system states, making the resulting feature vector highly suitable for the subsequent training of neuro-fuzzy networks. Experimental results demonstrate that the method successfully captures the synchronous correlation between hardware load spikes and the occurrence of critical errors.