LogRMC: Robust Log Anomaly Detection in IoT Systems via Multifield Fusion, Contrastive Learning, and Pseudo-Label Refinement

In large-scale Internet of Things (IoT) environments, the reliability and security of complex cloud-edge ecosystems critically depend on accurate anomaly detection from system logs. However, most existing methods rely primarily on log templates, often ignoring the diagnostic signals embedded in heterogeneous fields (e.g., timestamps, components, and severity levels). Furthermore, they struggle to learn discriminative representations for rare anomalies due to severe class imbalance, causing models to become biased toward normal patterns. Finally, these approaches often fail to capture the latent structure of unlabeled data, limiting their ability to generalize to unseen anomalies. These limitations render them unreliable in practice. To address the above challenges, we propose LogRMC, a semi-supervised framework for robust log anomaly detection through multi-field log feature fusion, contrastive representation learning, and pseudo-label refinement. First, LogRMC extracts features from diverse log fields and fuses them into unified contextual embeddings that encode inter-field dependencies. Next, it applies contrastive learning on normal samples to learn discriminative and stable representations, thereby improving the separation of normal and anomalous sequence embeddings. To exploit unlabeled data, LogRMC further introduces a cluster-refined pseudo-labeling strategy: it performs density-based clustering on contrastively learned embeddings and applies density ratio estimation within each cluster to generate confidence-aware pseudo-labels. Finally, an attention-based GRU network is trained jointly on labeled and pseudo-labeled log sequences. Extensive experiments on public log datasets demonstrate that LogRMC outperforms state-of-the-art unsupervised and semi-supervised methods, and achieves performance comparable to fully supervised approaches.