Aug 2026· PLoS ONE· Vol 21, pp. e0356907· 0 citations· 31 references
Medicine
TL;DR
Extensive experiments demonstrate that MeCoLog consistently outperforms state-of-the-art baselines under few-shot cross-system settings, offering a robust and highly transferable solution for real-world log anomaly detection.
Abstract
System logs are widely used for monitoring system reliability and detecting abnormal behaviors in large-scale computing infrastructures. While deep learning has significantly advanced log anomaly detection, most existing methods are confined to in-domain scenarios, relying heavily on abundant system-specific historical data. Consequently, they struggle to monitor newly deployed systems where log data and anomaly labels are severely scarce. Achieving robust cross-system log anomaly detection remains a challenge due to inherent domain gaps, including completely different logging structures, continuously evolving templates and severe Out-Of-Vocabulary issues. To bridge these gaps, we propose MeCoLog, a Meta-Contrastive learning method for cross-system log anomaly detection. First, a Hybrid Parameter Embedding is introduced to encode type, value, and key information to handle diverse vocabularies. These embeddings are integrated into the model via a Gated Key Injection mechanism and Rotary Position Embedding. These allow the model to capture both event relevance and execution flow. Second, we design an Asymmetric Prototype Contrastive Learning objective. This method aligns normal behaviors across different systems while strictly isolating anomalies. Together, this design enables MeCoLog to achieve robust performance in few-shot scenarios. Extensive experiments on multiple public log datasets (HDFS, BGL, Thunderbird, Hadoop and AIT-LDS v2.0) demonstrate that MeCoLog consistently outperforms state-of-the-art baselines under few-shot cross-system settings, offering a robust and highly transferable solution for real-world log anomaly detection.
LLM-Detector is proposed, a framework that utilizes the in-context learning capacity of LLMs for structured, prompt-conditioned scoring synthesis, enabling LLMs to derive anomaly detection logic from structured normal-state knowledge.
Tu Nguyen, Dang Nguyen, Thuc Duy Le et al.· 0 citations
Zero-shot anomaly detection (ZSAD) has gained significant attention for its practical value in industrial inspection. Recently, CLIP-based approaches have been widely adopted in ZSAD due to their strong vision-language generalization capabilities. However, existing methods commonly employ continuous prompt embeddings for prompt optimization and encode semantics in latent vectors, which lack interpretability and scalability. To this end, we propose CoEvoAD, a co-evolutionary framework for discrete prompt selection. CoEvoAD performs prompt search in the discrete natural-language space using an evolutionary algorithm. Candidate prompts are iteratively generated, evaluated, and selected throughout population evolution, thus preserving the interpretability and composability of natural language. Furthermore, we introduce a Cross-Category Transfer Objective (CCTO), which treats held-out source categories as proxies for unseen categories and scores prompt rules based on their estimated cross-category transferability, effectively improving cross-category generalization. Extensive experiments are conducted to validate the effectiveness of CoEvoAD, and the results show that it achieves state-of-the-art performance across multiple anomaly detection datasets. The code is available at https://github.com/rstao-bjtu/CoEvoAD.
Si-Si Zhu, Chang-Wei Yu, Renshuai Tao et al.· 0 citations
CARE, a model-agnostic cascaded inference framework that integrates a Lightweight Pre-filter Model (LPM) with an existing high-capacity Complex Detection Model (CDM) and introduces a Structure Attention module to explicitly capture channel-wise anomaly contributions, achieves inference speedup compared to the most accurate SOTA approaches.
Zemin Chao, Qian Xu, Jian-He Cen et al.· 0 citations
LogFusion is presented, a lightweight preprocessing pipeline that fuses contextual embeddings of log messages with engineered behavioural indicators to produce machine learning-ready features for unsupervised anomaly detection algorithms.
S. M. Aminur Rahman, A. Ullah, Masoud Mohammadian et al.· International Conference on...· 0 citations
Anomaly detection is crucial for ensuring system reliability and providing early warnings of potential failures. However, long-term time-series anomaly detection remains challenging because anomalous events are rare, anomaly patterns are diverse, and temporal dependencies can extend across multiple scales. Traditional methods and existing deep learning models still struggle to jointly represent fine-grained temporal variation, long-range contextual information, and the distribution of normal patterns. This work presents Transformer with Variational AutoEncoder (TransVAE), a framework that combines a dual-embedding representation pipeline, a Transformer encoder for long-range dependency modeling, and VAE-based latent regularization of encoded features. Specifically, local position-aware embeddings and feature-wise global embeddings are integrated into a shared representation before attention modeling, and the VAE is applied to the Transformer-encoded representation to regularize the latent space of normal patterns. Evaluations on benchmark time-series datasets show that TransVAE outperforms several state-of-the-art baselines, achieving improvements in the area under the receiver operating characteristic by 6.7% and 13.6%, respectively. Ablation and sensitivity analyses further support the contributions of each component of the framework. These results demonstrate that TransVAE provides an effective and robust solution for long-term time-series anomaly detection.
