MPFM: Cross Multi-Domain Prototype Flow Matching for Log Anomaly Detection

Abstract

Cross multi-domain log anomaly detection aims to train a unified model applying in multiple heterogeneous systems, alleviating the annotation cost and scalability bottlenecks of traditional cross single-domain approaches. However, existing methods face two fundamental challenges: (i) geometric proximity alone is insufficient to certify normality, and (ii) forcibly aligning distributions across domains can induce negative transfer. To address these issues, we propose MPFM (Cross Multi-Domain Prototype Flow Matching for Log Anomaly Detection), grounded in the principle that anomalies are samples that cannot be stably generated by the normal data-generating mechanism. Specifically, MPFM employs a shared–private prototype system to disentangle cross-domain commonalities from domain-specific patterns, introduces domain-conditioned flow matching to perform anomaly detection by integrating structural and dynamical evidence, and further leverages prototype-drift-driven hard example mining to improve robustness near decision boundaries. Experiments on HDFS, BGL, Thunderbird, and Spirit demonstrate that MPFM delivers substantial gains under multi-domain joint training.