MeCoLog: Meta-contrastive learning for cross-system few-shot log-based anomaly detection

System logs are widely used for monitoring system reliability and detecting abnormal behaviors in large-scale computing infrastructures. While deep learning has significantly advanced log anomaly detection, most existing methods are confined to in-domain scenarios, relying heavily on abundant system-specific historical data. Consequently, they struggle to monitor newly deployed systems where log data and anomaly labels are severely scarce. Achieving robust cross-system log anomaly detection remains a challenge due to inherent domain gaps, including completely different logging structures, continuously evolving templates and severe Out-Of-Vocabulary issues. To bridge these gaps, we propose MeCoLog, a Meta-Contrastive learning method for cross-system log anomaly detection. First, a Hybrid Parameter Embedding is introduced to encode type, value, and key information to handle diverse vocabularies. These embeddings are integrated into the model via a Gated Key Injection mechanism and Rotary Position Embedding. These allow the model to capture both event relevance and execution flow. Second, we design an Asymmetric Prototype Contrastive Learning objective. This method aligns normal behaviors across different systems while strictly isolating anomalies. Together, this design enables MeCoLog to achieve robust performance in few-shot scenarios. Extensive experiments on multiple public log datasets (HDFS, BGL, Thunderbird, Hadoop and AIT-LDS v2.0) demonstrate that MeCoLog consistently outperforms state-of-the-art baselines under few-shot cross-system settings, offering a robust and highly transferable solution for real-world log anomaly detection.

Authors

Institutions

Publication Details

Journal
PLoS ONE
Published
2026-08-27
DOI
https://doi.org/10.1371/journal.pone.0356907
Primary Topic
Software System Performance and Reliability
Type
article
Field-Weighted Citation Impact
0.00

Funders

Controls
|||
ALL TIME
JAN
FEB
MAR
APR
MAY
JUN
JUL
AUG
SEP
OCT
article

MeCoLog: Meta-contrastive learning for cross-system few-shot log-based anomaly detection

Tuan Phong Tran, Van Loi Cao, T. Dang, Manh Tuan Nguyen
PLoS ONE
Software System Performance and Reliability
article

MeCoLog: Meta-contrastive learning for cross-system few-shot log-based anomaly detection

Tuan Phong Tran, Van Loi Cao, T. Dang, Manh Tuan Nguyen
article en

Abstract

System logs are widely used for monitoring system reliability and detecting abnormal behaviors in large-scale computing infrastructures. While deep learning has significantly advanced log anomaly detection, most existing methods are confined to in-domain scenarios, relying heavily on abundant system-specific historical data. Consequently, they struggle to monitor newly deployed systems where log data and anomaly labels are severely scarce. Achieving robust cross-system log anomaly detection remains a challenge due to inherent domain gaps, including completely different logging structures, continuously evolving templates and severe Out-Of-Vocabulary issues. To bridge these gaps, we propose MeCoLog, a Meta-Contrastive learning method for cross-system log anomaly detection. First, a Hybrid Parameter Embedding is introduced to encode type, value, and key information to handle diverse vocabularies. These embeddings are integrated into the model via a Gated Key Injection mechanism and Rotary Position Embedding. These allow the model to capture both event relevance and execution flow. Second, we design an Asymmetric Prototype Contrastive Learning objective. This method aligns normal behaviors across different systems while strictly isolating anomalies. Together, this design enables MeCoLog to achieve robust performance in few-shot scenarios. Extensive experiments on multiple public log datasets (HDFS, BGL, Thunderbird, Hadoop and AIT-LDS v2.0) demonstrate that MeCoLog consistently outperforms state-of-the-art baselines under few-shot cross-system settings, offering a robust and highly transferable solution for real-world log anomaly detection.

PLoS ONEVol. 21(8)
Le Quy Don Technical University (VN)
National Foundation for Science and Technology Development, DeepMind
Industry, innovation and infrastructure
Openalex Percentile: Top 8%
Software System Performance and Reliability
AI Navigator

Ask Laika to Summarize, Analyze, and Connect papers live on the map.

Summarize Papers & Methodologies

Extract key findings, datasets, and comparative methods across publications.

Benchmark Rankings & Visual Analytics

Rank top research institutions, authors, funders, topics, and journals by Field-Weighted Citation Impact (FWCI) and paper volume with instant charts.

Connect Distant Disciplines

Bridge topological clusters on the map to find hidden collaborative intersections.