FusionLog: Multi-Domain Fusion Framework

Updated 15 November 2025

FusionLog is a multifaceted framework that fuses methodologies from cross-system anomaly detection, algebraic fusion in LCFT, and high-performance tokamak data analysis.
It employs a dual-branch approach in anomaly detection and leverages semantic routing, meta-learning, and LLM distillation to achieve >90% F1 score in zero-label settings.
Its modular architecture and rigorous decomposition principles enable reproducible insights in digital systems, mathematical physics, and fusion experiment infrastructures.

FusionLog refers to a spectrum of technical concepts and systems with origins in statistical physics, representation theory, lattice model algebra, log-based anomaly detection, and large-scale data infrastructure within fusion research. The term encompasses three distinct but thematically related technical domains: (1) cross-system log anomaly detection using fused general and proprietary knowledge in computer systems (Zhao et al., 8 Nov 2025), (2) lattice and categorical "fusion" rules in the representation theory of logarithmic conformal field theories and the Temperley–Lieb algebra (Bushlanov et al., 2011, Gainutdinov et al., 2012), and (3) high-performance real-time data access log analysis systems for experimental tokamak devices (Wang et al., 2018). Each context yields a distinct instantiation of FusionLog, unified by a focus on fusing, decomposing, and modeling complex log or event structures, either for system monitoring, anomaly detection, or the mathematical fusion product in representation categories.

1. FusionLog in Cross-System Log-Based Anomaly Detection

FusionLog, as defined in (Zhao et al., 8 Nov 2025), denotes a practical framework for zero-label log-based anomaly detection across heterogeneous computer systems. The objective is to enable reliable detection of anomalous behavior in target systems with no labeled logs, by fusing "general knowledge" (shared anomaly patterns across systems) with "proprietary knowledge" (system-specific patterns).

Architecture

FusionLog is a two-phase pipeline:

Semantic Similarity Routing: Raw logs are parsed (using Drain), embedded into a shared vector space, and partitioned into "general logs" (high semantic similarity to source) and "proprietary logs" (unique or low similarity).

Let $x = \{l_1,\ldots,l_n\}$ denote a target log sequence with per-token embedding $v_i\in\mathbb{R}^d$ , and $V^{source} = \{u_1,\ldots,u_m\}$ the source event prototypes. The event-level alignment is $\operatorname{sim}_i = \max_j \cos(v_i, u_j)$ , and the sequence-level score $s(x) = \min_i \operatorname{sim}_i$ .
With threshold $\tau$ , route $x$ into the general set $\mathcal{G}$ if $s(x)\ge\tau$ , else to the proprietary set $\mathcal{P}$ .

Dual-Branch Anomaly Detection:
- General Logs: A small GRU-attention model, trained via system-agnostic meta-learning (with adversarial domain discrimination), detects anomalies that match known patterns.
  - The meta-learning update for feature extractor $\theta_e$ is:
$\theta_e^i = \theta_e - \delta \nabla_{\theta_e} \left[ \gamma L_c(M_i^{sup}) - \beta L_{ad}(M_i^{sup}) \right]$

- Outer-loop meta-update for $\theta_e$ :

$\theta_e \leftarrow \theta_e - \alpha \nabla_{\theta_e} \sum_i L_{MT_i}(M_i^{que}; \theta_e^i)$

Proprietary Logs: An iterative knowledge distillation protocol injects proprietary knowledge into the small model from a LLM using retrieval-augmented generation (RAG) and dynamic confidence thresholds.
- For each round, (i) the LLM pseudo-labels proprietary samples, (ii) the small model produces its own predictions and confidences, (iii) clean samples (high-confidence, agreeing predictions) are used to fine-tune the small model, (iv) the LLM's RAG base is augmented.

Technical Significance

FusionLog achieves $>90\%$ $F_1$ score across multiple public datasets under zero-label settings (Zhao et al., 8 Nov 2025). The semantic router ensures that general cross-system patterns are exploited where applicable, while proprietary knowledge—unique to each target system—is fused into the detection model via collaborative LLM–small model distillation. This decomposition and two-branch treatment represent the first principled strategy for addressing general/proprietary mismatch in log anomaly detection. The system's modularity, ability to operate without any target labels, and successful empirical results mark a significant advance over conventional transfer and meta-learning approaches.

2. FusionLog in Lattice Fusion and Logarithmic CFT

FusionLog also refers to the compositional algebraic and categorical theory of fusion rules—specifically, the Temperley–Lieb (TL) fusion functor—underlying logarithmic conformal field theories (LCFTs) and associated lattice models (Bushlanov et al., 2011, Gainutdinov et al., 2012).

Temperley–Lieb Fusion Functor

The TL algebra $\mathrm{TL}_n(\delta)$ is generated by $e_1,\ldots,e_{n-1}$ with relations:

$e_i^2 = \delta e_i, \quad e_i e_{i\pm1} e_i = e_i, \quad [e_i, e_j]=0 \ (|i-j|>1)$

The TL fusion functor $\times_f$ induces, for modules $M_1$ and $M_2$ :

$M_1 \times_f M_2 = \mathrm{TL}_{N_1+N_2} \otimes_{\mathrm{TL}_{N_1}\otimes \mathrm{TL}_{N_2}} (M_1 \otimes M_2)$

At generic $q$ (TL semisimple), the fusion of standard modules is multiplicity-free and corresponds bijectively to the addition of through-lines.
At roots of unity, TL is non-semisimple: standard modules decompose into irreducibles and indecomposable projective covers.

LCFT Correspondence

The non-diagonal action of the lattice Hamiltonian on indecomposable TL projectives leads, in the scaling limit, to staggered Virasoro modules with logarithmic coupling (Jordan block structure in $L_0$ ).
These "fusion products" in the lattice map directly to fusion rules for Kac modules and projective objects in logarithmic CFT, with indecomposability parameters (the "β-invariant") analytically controlling logarithmic OPE coefficients.
The rigorous derivation of these fusion rules is provided via quantum group representation theory (e.g., Lusztig’s $U_q(\mathfrak{sl}_2)$ at root of unity), and the functorial correspondence between the quantum group and Virasoro algebra is established via Kazhdan–Lusztig equivalence (Bushlanov et al., 2011).

Context and Impact

The algebraic technology of FusionLog enables the analysis of logarithmic singularities in LCFT boundary OPEs, explaining phenomena such as the emergence of logarithmic partner fields and the structural distinction between rational and logarithmic CFT fusion rules. Theoretical predictions for operator product expansions in e.g. percolation and critical polymers are grounded in the lattice fusion algebras, tying rigorous computational results to physical predictions.

3. FusionLog in Tokamak Data Infrastructure

FusionLog is also the designation (Editor's term) for the real-time data access log analysis infrastructure deployed at the EAST tokamak for MDSplus-based experimental workflows (Wang et al., 2018). The system robustly handles high-throughput experimental data streams, enabling operational auditing, anomaly detection, and live monitoring.

System Architecture

The architecture comprises five modular components:

+-----------------+   +----------+   +---------+   +-----------+   +--------------+
|  Part 1:        |   |  Part 2: |   | Part 3: |   | Part 4:    |   | Part 5:      |
|  MDSPlus        |──▶|  Flume   |──▶| HDFS    |──▶|Spark       |──▶| MySQL + Web  |
|  Hook-Logger    |   |  Agent   |   | Storage |   |Streaming   |   | + Zeppelin   |
+-----------------+   +----------+   +---------+   +-----------+   +--------------+

Part 1: Data Collection—A shared library hook within the MDSplus server appends granular log lines on client operations; these logs serve as the canonical input.
Part 2: Flume Message Brokering—A Flume NG agent, configured with disk channel (for reliability) and memory channel (for speed), delivers logs to HDFS and Kafka topics, providing decoupled, resilient ingestion.
Part 3: Storage—Raw logs persist in HDFS for batch analytics; Kafka serves as the streaming intermediary.
Part 4: Stream Processing—Spark Streaming ingests from Kafka, applies record validation, transformation, enrichment, and writes results to MySQL.
Part 5: Visualization—Web dashboards (ECharts, Zeppelin) enable live and retrospective analysis.

Performance and Reliability

The system achieves near-linear scaling with Spark executors: e.g., with $\mu \sim 5\,000$ events/sec/core, to meet $\lambda=200\,000$ events/sec, at least 40 cores are provisioned.
Sustained rates up to $10^6$ events/sec with <2 s end-to-end latency and batch commit times of approximately 1.1 s are reported.
Reliability is ensured via disk channel durability in Flume, Kafka topic replication ( $\mathrm{RF} \geq 2$ ), driver checkpointing in Spark, and strict partitioning between archival and streaming stores (HDFS/Kafka).

Extensibility

The hook→Flume→Kafka→Spark→MySQL→Web pattern is portable to any MDSplus-based device, enabling rapid deployment for other fusion experiments. Best practices include provisioning for maximum peak rates plus overhead, ensuring durability at all ingestion stages, and monitoring end-to-end latency with observability tooling.

4. Comparative Table: Domains of "FusionLog"

Domain	Central Concept	Key Operation/Phenomenon
Cross-System Anomaly Detection	Semantic routing and meta/distillation fusion	Fusing general and proprietary patterns
Lattice Fusion/LCFT	Algebraic fusion in categorical representation theory	Non-semisimple TL fusion, log OPEs
Tokamak Log Analysis	Streaming, distributed log analytics infrastructure	Real-time MDSplus log observability

While unrelated in implementation, all three instances address the challenge of fusing heterogeneity—be it pattern sources, algebraic modules, or experimental event streams—by formal decomposition and recombination, resulting in robust detection (digital systems), analytical rigor (mathematical physics), or operational reliability (experimental science).

5. Limitations and Future Directions

In cross-system log anomaly detection, the efficacy of FusionLog depends on high-quality event embeddings and the choice of routing threshold, as pathological tuning may starve one pipeline branch. Reliance on powerful LLMs and RAG infrastructure increases system complexity, and the framework currently addresses only textual logs, leaving multimodal integration (e.g., configs, code) as open problems. Extending to continual log concept drift and streaming learning remains a research frontier (Zhao et al., 8 Nov 2025).
In algebraic and LCFT applications, computation of indecomposability parameters and explicit module decompositions can require substantial technical machinery. Extending the categorical framework of lattice fusion to broader classes of logarithmic field theories and more general quantum group settings is ongoing (Bushlanov et al., 2011, Gainutdinov et al., 2012).
In fusion experiment infrastructure, scalability is bounded by Spark cluster sizing and the efficiency of ingestion nodes (Flume-agents), although empirical results demonstrate robust handling of high-throughput streams. Generalization to a wider variety of scientific log formats is facilitated by the modular architecture (Wang et al., 2018).

6. Significance Across Disciplines

FusionLog manifests across information science, mathematical physics, and experimental infrastructure as a mechanism for integrating distinct sources of structure—whether data, patterns, or algebraic objects—via considered fusion, routing, or decomposition. In anomaly detection, the division of task by semantic alignment and two-step knowledge fusion yields state-of-the-art zero-label performance (Zhao et al., 8 Nov 2025). In representation theory and LCFT, fusion functors and their indecomposable outputs explain logarithmic phenomena in critical physical models (Bushlanov et al., 2011, Gainutdinov et al., 2012). In experimental facilities, FusionLog enables sub-second system observability at scales relevant to modern fusion research (Wang et al., 2018).

A plausible implication is that this conceptual thread—the rigorous partitioning and fusion of informational, algebraic, or operational heterogeneity—represents a broadly applicable principle across scientific domains.