Drift-Aware Multi-Scale Temporal–Logical Scoring for Online Log Anomaly Detection

Adaptive log detectors must distinguish valid workload migration from rare operational faults. We examine DATS, a compact online architecture that combines multi-kernel temporal attention, component-transition surprise, and a drifting quantile cutoff. Its convolutional front end adopts the three temporal scales and learned attention-based scale fusion of the Temporal Logical Attention Network (TLAN). Unlike evaluations restricted to neural ablations, we compare against smoothed first-order Markov predictors and test both first-order and explicit 3-/7-event-lag generators using chronological, label-hidden updates. Across nine first-order drift streams, DATS attains mean F1 0.280 versus 0.239 for static temporal–logical fusion, but static Markov reaches 0.350. In nine long-context drift streams, DATS reaches 0.229 compared with 0.195 for online Markov and 0.100 for static Markov. Rare-anomaly and noisy-normal stress tests reveal additional weaknesses. The study establishes a reproducible conditional advantage for online multi-scale scoring, rather than an unconditional superiority claim; all results are from synthetic streams.