{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,27]],"date-time":"2026-08-27T18:20:28Z","timestamp":1787854828933,"version":"build-2784847793"},"reference-count":32,"publisher":"Public Library of Science (PLoS)","issue":"8","license":[{"start":{"date-parts":[[2026,8,27]],"date-time":"2026-08-27T00:00:00Z","timestamp":1787788800000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/100007224","name":"NAFOSTED","doi-asserted-by":"crossref","award":["102.01-2023.35"],"award-info":[{"award-number":["102.01-2023.35"]}],"id":[{"id":"10.13039\/100007224","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["www.plosone.org"],"crossmark-restriction":false},"short-container-title":["PLoS One"],"abstract":"<jats:p>System logs are widely used for monitoring system reliability and detecting abnormal behaviors in large-scale computing infrastructures. While deep learning has significantly advanced log anomaly detection, most existing methods are confined to in-domain scenarios, relying heavily on abundant system-specific historical data. Consequently, they struggle to monitor newly deployed systems where log data and anomaly labels are severely scarce. Achieving robust cross-system log anomaly detection remains a challenge due to inherent domain gaps, including completely different logging structures, continuously evolving templates and severe Out-Of-Vocabulary issues. To bridge these gaps, we propose MeCoLog, a Meta-Contrastive learning method for cross-system log anomaly detection. First, a Hybrid Parameter Embedding is introduced to encode type, value, and key information to handle diverse vocabularies. These embeddings are integrated into the model via a Gated Key Injection mechanism and Rotary Position Embedding. These allow the model to capture both event relevance and execution flow. Second, we design an Asymmetric Prototype Contrastive Learning objective. This method aligns normal behaviors across different systems while strictly isolating anomalies. Together, this design enables MeCoLog to achieve robust performance in few-shot scenarios. Extensive experiments on multiple public log datasets (HDFS, BGL, Thunderbird, Hadoop and AIT-LDS v2.0) demonstrate that MeCoLog consistently outperforms state-of-the-art baselines under few-shot cross-system settings, offering a robust and highly transferable solution for real-world log anomaly detection.<\/jats:p>","DOI":"10.1371\/journal.pone.0356907","type":"journal-article","created":{"date-parts":[[2026,8,27]],"date-time":"2026-08-27T17:35:46Z","timestamp":1787852146000},"page":"e0356907","update-policy":"https:\/\/doi.org\/10.1371\/journal.pone.corrections_policy","source":"Crossref","is-referenced-by-count":0,"title":["MeCoLog: Meta-contrastive learning for cross-system few-shot log-based anomaly detection"],"prefix":"10.1371","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0009-0006-3863-5070","authenticated-orcid":true,"given":"Manh Tuan","family":"Nguyen","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tuan Phong","family":"Tran","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Le Dinh Trang","family":"Dang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3637-9230","authenticated-orcid":true,"given":"Van Loi","family":"Cao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"340","published-online":{"date-parts":[[2026,8,27]]},"reference":[{"key":"pone.0356907.ref001","doi-asserted-by":"crossref","unstructured":"Xu W, Huang L, Fox A, Patterson D, Jordan MI. Detecting large-scale system problems by mining console logs. In: Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles, 2009. 117\u201332. https:\/\/doi.org\/10.1145\/1629575.1629587","DOI":"10.1145\/1629575.1629587"},{"key":"pone.0356907.ref002","doi-asserted-by":"crossref","unstructured":"He S, Zhu J, He P, Lyu MR. Experience Report: System Log Analysis for Anomaly Detection. In: 2016 IEEE 27th International Symposium on Software Reliability Engineering (ISSRE), 2016. 207\u201318. https:\/\/doi.org\/10.1109\/issre.2016.21","DOI":"10.1109\/ISSRE.2016.21"},{"key":"pone.0356907.ref003","doi-asserted-by":"crossref","first-page":"100470","DOI":"10.1016\/j.mlwa.2023.100470","article-title":"Deep learning for anomaly detection in log data: A survey","volume":"12","author":"M Landauer","year":"2023","journal-title":"Machine Learning with Applications"},{"issue":"1","key":"pone.0356907.ref004","article-title":"Anomaly detection in virtual machine logs against irrelevant attribute interference","volume":"20","author":"H Zhang","year":"2025","journal-title":"PLoS One"},{"key":"pone.0356907.ref005","doi-asserted-by":"crossref","unstructured":"Du M, Li F, Zheng G, Srikumar V. Deeplog: Anomaly detection and diagnosis from system logs through deep learning. In: Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, 2017. 1285\u201398.","DOI":"10.1145\/3133956.3134015"},{"key":"pone.0356907.ref006","doi-asserted-by":"crossref","unstructured":"Meng W, Liu Y, Zhu Y, Zhang S, Pei D, Liu Y. Loganomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs. In: Ijcai, 2019. 4739\u201345.","DOI":"10.24963\/ijcai.2019\/658"},{"key":"pone.0356907.ref007","doi-asserted-by":"crossref","unstructured":"He P, Zhu J, Zheng Z, Lyu MR. Drain: An Online Log Parsing Approach with Fixed Depth Tree. In: 2017 IEEE International Conference on Web Services (ICWS), 2017. 33\u201340. https:\/\/doi.org\/10.1109\/icws.2017.13","DOI":"10.1109\/ICWS.2017.13"},{"key":"pone.0356907.ref008","doi-asserted-by":"crossref","unstructured":"Guo H, Yuan S, Wu X. LogBERT: Log Anomaly Detection via BERT. In: 2021 International Joint Conference on Neural Networks (IJCNN), 2021. 1\u20138. https:\/\/doi.org\/10.1109\/ijcnn52387.2021.9534113","DOI":"10.1109\/IJCNN52387.2021.9534113"},{"key":"pone.0356907.ref009","doi-asserted-by":"crossref","unstructured":"Zhang X, Xu Y, Lin Q, Qiao B, Zhang H, Dang Y, et al. Robust log-based anomaly detection on unstable log data. In: Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, 2019. 807\u201317. https:\/\/doi.org\/10.1145\/3338906.3338931","DOI":"10.1145\/3338906.3338931"},{"key":"pone.0356907.ref010","doi-asserted-by":"crossref","unstructured":"Chen R, Zhang S, Li D, Zhang Y, Guo F, Meng W, et al. LogTransfer: Cross-System Log Anomaly Detection for Software Systems with Transfer Learning. In: 2020 IEEE 31st International Symposium on Software Reliability Engineering (ISSRE), 2020. 37\u201347. https:\/\/doi.org\/10.1109\/issre5003.2020.00013","DOI":"10.1109\/ISSRE5003.2020.00013"},{"key":"pone.0356907.ref011","doi-asserted-by":"crossref","first-page":"124082","DOI":"10.1016\/j.eswa.2024.124082","article-title":"LogGT: Cross-system log anomaly detection via heterogeneous graph feature and transfer learning","volume":"251","author":"P Wang","year":"2024","journal-title":"Expert Systems with Applications"},{"key":"pone.0356907.ref012","doi-asserted-by":"crossref","unstructured":"Han X, Yuan S. Unsupervised Cross-system Log Anomaly Detection via Domain Adaptation. In: Proceedings of the 30th ACM International Conference on Information & Knowledge Management, 2021. 3068\u201372. https:\/\/doi.org\/10.1145\/3459637.3482209","DOI":"10.1145\/3459637.3482209"},{"key":"pone.0356907.ref013","doi-asserted-by":"crossref","unstructured":"Zhang C, Jia T, Shen G, Zhu P, Li Y. MetaLog: Generalizable Cross-System Anomaly Detection from Logs with Meta-Learning. In: Proceedings of the IEEE\/ACM 46th International Conference on Software Engineering, 2024. 1\u201312. https:\/\/doi.org\/10.1145\/3597503.3639205","DOI":"10.1145\/3597503.3639205"},{"key":"pone.0356907.ref014","unstructured":"Chen T, Kornblith S, Norouzi M, Hinton G. In: International conference on machine learning, 2020. 1597\u2013607."},{"issue":"1","key":"pone.0356907.ref015","doi-asserted-by":"crossref","DOI":"10.1371\/journal.pone.0262463","article-title":"A simple method for unsupervised anomaly detection: An application to Web time series data","volume":"17","author":"K Yoshihara","year":"2022","journal-title":"PLoS One"},{"key":"pone.0356907.ref016","doi-asserted-by":"crossref","unstructured":"Le V-H, Zhang H. Log-based Anomaly Detection Without Log Parsing. In: 2021 36th IEEE\/ACM International Conference on Automated Software Engineering (ASE), 2021. 492\u2013504. https:\/\/doi.org\/10.1109\/ase51524.2021.9678773","DOI":"10.1109\/ASE51524.2021.9678773"},{"key":"pone.0356907.ref017","doi-asserted-by":"crossref","unstructured":"Yang L, Chen J, Wang Z, Wang W, Jiang J, Dong X, et al. PLELog: Semi-Supervised Log-Based Anomaly Detection via Probabilistic Label Estimation. In: 2021 IEEE\/ACM 43rd International Conference on Software Engineering: Companion Proceedings (ICSE-Companion), 2021. 230\u20131. https:\/\/doi.org\/10.1109\/icse-companion52605.2021.00106","DOI":"10.1109\/ICSE-Companion52605.2021.00106"},{"key":"pone.0356907.ref018","doi-asserted-by":"crossref","first-page":"127063","DOI":"10.1016\/j.neucom.2023.127063","article-title":"RoFormer: Enhanced transformer with Rotary Position Embedding","volume":"568","author":"J Su","year":"2024","journal-title":"Neurocomputing"},{"key":"pone.0356907.ref019","doi-asserted-by":"crossref","unstructured":"Zhao N, Wang H, Li Z, Peng X, Wang G, Pan Z, et al. An empirical investigation of practical log anomaly detection for online service systems. In: Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, 2021. 1404\u201315. https:\/\/doi.org\/10.1145\/3468264.3473933","DOI":"10.1145\/3468264.3473933"},{"key":"pone.0356907.ref020","doi-asserted-by":"crossref","unstructured":"Du M, Li F. Spell: Streaming Parsing of System Event Logs. In: 2016 IEEE 16th International Conference on Data Mining (ICDM), 2016. 859\u201364. https:\/\/doi.org\/10.1109\/icdm.2016.0103","DOI":"10.1109\/ICDM.2016.0103"},{"key":"pone.0356907.ref021","doi-asserted-by":"crossref","unstructured":"Liu Y, Zhang X, He S, Zhang H, Li L, Kang Y, et al. UniParser: A Unified Log Parser for Heterogeneous Log Data. In: Proceedings of the ACM Web Conference 2022, 2022. 1893\u2013901. https:\/\/doi.org\/10.1145\/3485447.3511993","DOI":"10.1145\/3485447.3511993"},{"key":"pone.0356907.ref022","doi-asserted-by":"crossref","unstructured":"Lin Q, Zhang H, Lou J-G, Zhang Y, Chen X. Log clustering based problem identification for online service systems. In: Proceedings of the 38th International Conference on Software Engineering Companion, 2016. 102\u201311. https:\/\/doi.org\/10.1145\/2889160.2889232","DOI":"10.1145\/2889160.2889232"},{"issue":"4","key":"pone.0356907.ref023","doi-asserted-by":"crossref","first-page":"2064","DOI":"10.1109\/TNSM.2020.3034647","article-title":"HitAnomaly: Hierarchical Transformers for Anomaly Detection in System Log","volume":"17","author":"S Huang","year":"2020","journal-title":"IEEE Trans Netw Serv Manage"},{"issue":"2","key":"pone.0356907.ref024","doi-asserted-by":"crossref","first-page":"1150","DOI":"10.1109\/TDSC.2024.3428538","article-title":"Log Sequence Anomaly Detection Based on Template and Parameter Parsing via BERT","volume":"22","author":"X Chai","year":"2025","journal-title":"IEEE Trans Dependable and Secure Comput"},{"issue":"1","key":"pone.0356907.ref025","doi-asserted-by":"crossref","first-page":"135","DOI":"10.1609\/aaai.v38i1.27764","article-title":"LogFormer: A Pre-train and Tuning Pipeline for Log Anomaly Detection","volume":"38","author":"H Guo","year":"2024","journal-title":"AAAI"},{"key":"pone.0356907.ref026","doi-asserted-by":"crossref","unstructured":"Reimers N, Gurevych I. Sentence-BERT: Sentence Embeddings using Siamese BERT-Networks. In: Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), 2019. 3980\u201390. https:\/\/doi.org\/10.18653\/v1\/d19-1410","DOI":"10.18653\/v1\/D19-1410"},{"key":"pone.0356907.ref027","first-page":"18661","article-title":"Supervised contrastive learning","volume":"33","author":"P Khosla","year":"2020","journal-title":"Advances in Neural Information Processing Systems"},{"key":"pone.0356907.ref028","article-title":"Prototypical networks for few-shot learning","volume":"30","author":"J Snell","year":"2017","journal-title":"Advances in Neural Information Processing Systems"},{"key":"pone.0356907.ref029","article-title":"Matching Networks for One Shot Learning.","volume-title":"Advances in Neural Information Processing Systems","author":"O Vinyals","year":"2016"},{"key":"pone.0356907.ref030","doi-asserted-by":"crossref","first-page":"2733","DOI":"10.1109\/JSAC.2025.3644295","article-title":"Large-Small Model Collaboration in Mobile Edge Networks With Heterogeneous Computational Resources","volume":"44","author":"L Cheng","year":"2026","journal-title":"IEEE J Sel Areas Commun"},{"key":"pone.0356907.ref031","doi-asserted-by":"crossref","unstructured":"Oliner A, Stearley J. What Supercomputers Say: A Study of Five System Logs. In: 37th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN\u201907), 2007. 575\u201384. https:\/\/doi.org\/10.1109\/dsn.2007.103","DOI":"10.1109\/DSN.2007.103"},{"issue":"4","key":"pone.0356907.ref032","doi-asserted-by":"crossref","first-page":"3466","DOI":"10.1109\/TDSC.2022.3201582","article-title":"Maintainable Log Datasets for Evaluation of Intrusion Detection Systems","volume":"20","author":"M Landauer","year":"2023","journal-title":"IEEE Trans Dependable and Secure Comput"}],"container-title":["PLOS One"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0356907","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,8,27]],"date-time":"2026-08-27T17:35:53Z","timestamp":1787852153000},"score":1,"resource":{"primary":{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0356907"}},"subtitle":[],"editor":[{"given":"Ming","family":"Zhang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"editor"}]}],"short-title":[],"issued":{"date-parts":[[2026,8,27]]},"references-count":32,"journal-issue":{"issue":"8","published-online":{"date-parts":[[2026,8,27]]}},"URL":"https:\/\/doi.org\/10.1371\/journal.pone.0356907","relation":{},"ISSN":["1932-6203"],"issn-type":[{"value":"1932-6203","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,8,27]]}}}