A Mathematical Modeling Framework for Semantic–Temporal Graph Learning in Log Anomaly Detection

System logs provide valuable information for monitoring system states, identifying failures, and detecting anomalous behaviour in large-scale distributed computing systems. However, their unstructured text, complex semantic dependencies, temporal variation, and severe class imbalance limit conventional methods based on event templates, sequence statistics, or shallow features. To address these challenges, this study proposes a unified mathematical modelling framework for log anomaly detection, instantiated as the Conditional Graph Attention Transformer for Log Analysis (CGATLog). The framework represents temporally ordered log observations as a weighted attributed graph and jointly models semantic representations, event dependencies, temporal associations, and minority-class distributions. A BERT-Transformer encoder first extracts contextual semantic representations from log entries. A weighted log graph is then constructed from event-transition relationships, semantic similarity, and temporal proximity. To alleviate anomaly scarcity, anomalous node representations are generated in the graph embedding space and connected to the original graph through a learnable edge-relation predictor. A semantic–temporal gated graph attention mechanism further regulates the contributions of semantic and temporal associations during neighbourhood aggregation. Experiments on HDFS, BGL, and Thunderbird show that CGATLog achieves competitive log anomaly detection performance. The results also confirm that semantic–temporal graph modelling and anomaly sample augmentation improve robustness, particularly under severe class imbalance.