As high-performance parallel and distributed computing (HPDC) systems grow in scale, heterogeneity, and operational complexity, maintaining their security and reliability demands fast, accurate log anomaly detection (LAD) across massive volumes of system logs. Existing LAD methods often struggle with log volume, diversity, manual threshold tuning, and rare or context-dependent anomalies. To address these limitations, this research presents RE-LAD, a streaming LAD ensemble framework for HPDC systems. RE-LAD combines scalable log ingestion via Apache Kafka with a robust ensemble anomaly detector whose base detectors extend Transformer-based anomaly detection and automatically calibrate detection thresholds. RE-LAD features BAT (Bagging-style ensemble of enhanced Anomaly Transformers) as its core detection component to improve detection robustness. The experimental results on Hadoop Distributed File System (HDFS) and Blue Gene/L supercomputer (BGL) logs show that BAT outperforms leading methods.

The rapid growth of the Internet of Things (IoT) and the increasing interconnectivity of industrial systems are driving a critical need for anomaly detection to be performed locally on edge devices. However, a significant gap exists between the computational power required by advanced deep learning models and the limited resources of edge hardware, often forcing a compromise between detection capability and on-device feasibility. To bridge this gap, we first introduce the EM-AT and its variants (EM-AT-bin), which enhance the Anomaly Transformer (AT) by integrating the Expectation–Maximization (EM) algorithm to enable fully automated, data-driven threshold determination. The EM-AT model with a Bayesian information criterion (BIC) estimator achieves the highest detection performance across four public datasets (i.e., SWaT, WADI, HDFS, and OpenStack), with $$F_{1}$$ -scores of 96.32%, 92.47%, 98.90%, and 99.61%, respectively. Building on the EM-AT and its variants, we present Q-EM-AT (Quantized-EM-AT) and its variants (Q-EM-AT-bin), edge-optimized and quantized variants that leverage mixed-precision quantization to substantially reduce computational and memory overhead while preserving detection accuracy. Finally, we propose TransEdge, a lightweight edge anomaly detection framework that adopts Q-EM-AT as its core detector to balance detection performance and computational resource consumption. Comprehensive experiments show that TransEdge significantly reduces resource consumption while maintaining competitive detection performance, achieving $$F_{1}$$ -scores of 96.18% on SWaT, 92.36% on WADI, 98.65% on HDFS, and 99.43% on OpenStack.

Distributed systems, prevalent in safety-critical domains, produce vast logs containing essential runtime data. Log Anomaly Detection (LAD) is vital for maintaining the security and reliability of these systems, yet traditional methods falter amid growing data complexity and scale. While modern deep learning approaches such as LSTM excel at pattern recognition, they inadequately model the long-term dependencies found in log sequences. To address these challenges, we introduce HPCLog (High-throughput Processing Collection Log), a transformerbased LAD framework tailored for distributed systems. HPCLog is built upon EM-AT, a novel unsupervised anomaly detection model that extends the Anomaly Transformer. By integrating an Expectation-Maximization (EM) algorithm, EM-AT enables fully automated threshold determination. HPCLog seamlessly integrates this EM-AT model with Apache Kafka, creating a highthroughput pipeline for log collection and processing that enables accurate anomaly detection with low latency. Experimental results on two public datasets demonstrate that HPCLog surpasses leading methods, achieving$F_{1}$-scores of$\mathbf{9 8. 9 0 \%}$on HDFS and 99.61% on OpenStack.

Modern software systems generate massive numbers of log messages, driving the need for automatic log analysis to detect anomalies.Besides, the growing adoption of edge computing highlights the importance of performing log anomaly detection (LAD) on edge devices.However, traditional methods struggle to handle complex and largescale log data effectively.While recent deep learning methods, although effective, are hindered by high computational demands, they are undesirable for power-constrained edge deployment.To solve these problems, we introduce Du-alATLog, a Dual-mode Anomaly Transformer-based framework for software system log anomaly detection across varying environments.DualATLog operates in two distinct modes-a standard mode optimized for environments with sufficient computational resources, and a power-saving mode designed explicitly for low-power edge devices.Experiments on two popular public datasets demonstrate the superior performance of the standard mode with an F 1score of 98.78% on HDFS and 99.56% on OpenStack, while the power-saving mode exhibits only a slight performance reduction.Power consumption measurements further validate our framework's ability to be seamlessly deployed in different environments.

Cyber-Physical Systems (CPS) in water treatment and distribution are critical to smart city infrastructure.While CPS integration enhances operational efficiency, it also expands the attack surface, making robust anomaly detection crucial.Traditional deep learning approaches, despite their effectiveness in anomaly detection, are often too computationally intensive for resource-constrained edge devices prevalent in smart city deployments.To address this challenge, we introduce EATW (a novel Energy-efficient Anomaly Transformer-based anomaly detection architecture for Water treatment and distribution systems).EATW offers two modes: a performance mode for optimal detection capability where computational resources are ample, and an energy-efficient mode for low-resource edge devices, leveraging torchao technology and ExecuTorch framework to achieve crucial balance between accurate detection and operational efficiency.Evaluations using SWaT and WADI water system facility datasets demonstrate EATW's efficacy.The performance mode achieved superior results on the WADI and equaled the best results on SWaT compared with leading methods, while the energy-efficient mode curtails resource consumption with only a marginal 1-2% decrease in F 1 score.This highlights EATW's capability to deliver efficient and reliable anomaly detection, enhancing the water system facilities' security within smart city application ecosystems.