{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,30]],"date-time":"2026-07-30T14:13:16Z","timestamp":1785420796628,"version":"3.56.0"},"reference-count":38,"publisher":"MDPI AG","issue":"5","license":[{"start":{"date-parts":[[2026,4,24]],"date-time":"2026-04-24T00:00:00Z","timestamp":1776988800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"crossref","award":["62272126"],"award-info":[{"award-number":["62272126"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"award":["62272126"],"award-info":[{"award-number":["62272126"]}],"id":[{"id":"https:\/\/ror.org\/01h0zpd94","id-type":"ROR","asserted-by":"publisher"}]},{"name":"the Fundamental Research Funds for the Central Universities","award":["3072024LJ0602"],"award-info":[{"award-number":["3072024LJ0602"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Computers"],"abstract":"<jats:p>System logs have been critical for analyzing the operational status and abnormal behavior of highly distributed and heterogeneous edge computing nodes. In edge environments, logs exhibit cross-event and cross-field structural interactions, making it difficult to uncover potential anomaly patterns from isolated events. Moreover, sparse annotations and varying log formats limit the effectiveness of existing methods. To address these challenges, we propose a graph neural network (GNN) anomaly detection framework with prompt learning. It leverages few-shot prompt learning to automatically extract key fields and constructs a weighted directed graph that jointly models semantic embeddings and temporal dependencies, fully representing the structural interactions and semantic associations across events and fields. Furthermore, the framework performs graph-level anomaly detection by jointly optimizing graph representation learning and classification objective within an enhanced one-class directed graph convolutional network, enabling effective identification of global structural anomaly patterns in log graphs. Experimental results demonstrate that the proposed method achieves an average F1-score of 93.3%, surpassing the current state-of-the-art (SOTA) methods by 6.93%.<\/jats:p>","DOI":"10.3390\/computers15050273","type":"journal-article","created":{"date-parts":[[2026,4,24]],"date-time":"2026-04-24T14:28:23Z","timestamp":1777040903000},"page":"273","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["A GNN-Based Log Anomaly Detection Framework with Prompt Learning for Edge Computing"],"prefix":"10.3390","volume":"15","author":[{"given":"Xianlang","family":"Hu","sequence":"first","affiliation":[{"name":"College of Computer Science and Technology, Harbin Engineering University, Harbin 150001, China"},{"name":"Jiangsu Institute of Automation, Lianyungang  222006, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7192-1622","authenticated-orcid":false,"given":"Guangsheng","family":"Feng","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology, Harbin Engineering University, Harbin 150001, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xinling","family":"Huang","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology, Harbin Engineering University, Harbin 150001, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiangying","family":"Kong","sequence":"additional","affiliation":[{"name":"Jiangsu Institute of Automation, Lianyungang  222006, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hongwu","family":"Lv","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology, Harbin Engineering University, Harbin 150001, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,4,24]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Wang, Z., Tian, J., Fang, H., Chen, L., and Qin, J. (2022). LightLog: A lightweight temporal convolutional network for log anomaly detection on the edge. Comput. Netw., 203.","DOI":"10.1016\/j.comnet.2021.108616"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"4456","DOI":"10.1109\/TNET.2024.3423780","article-title":"Federated PCA on Grassmann Manifold for IoT Anomaly Detection","volume":"32","author":"Nguyen","year":"2024","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"96","DOI":"10.1145\/3575637.3575652","article-title":"Feature selection for fault detection and prediction based on event log analysis","volume":"24","author":"Li","year":"2022","journal-title":"ACM SIGKDD Explor. Newsl."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Zhang, W., Zhang, Q., Yu, E., Ren, Y., Meng, Y., Qiu, M., and Wang, J. (2024, January 7\u201313). LogRAG: Semi-Supervised Log-based Anomaly Detection with Retrieval-Augmented Generation. Proceedings of the IEEE International Conference on Web Services (ICWS), Shenzhen, China.","DOI":"10.1109\/ICWS62655.2024.00129"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"12095","DOI":"10.1109\/TKDE.2021.3139086","article-title":"Anomaly rule detection in sequence data","volume":"35","author":"Gan","year":"2021","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_6","unstructured":"Liu, J., Huang, J., Huo, Y., Jiang, Z., Gu, J., Chen, Z., Feng, C., Yan, M., and Lyu, M.R. (2023). Log-based Anomaly Detection based on EVT Theory with feedback. arXiv."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"2863","DOI":"10.1109\/TCSS.2023.3297233","article-title":"Fr\u00e9chet-Statistics-Based Change Point Detection in Dynamic Social Networks","volume":"11","author":"Luo","year":"2024","journal-title":"IEEE Trans. Comput. Soc. Syst."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Du, M., Li, F., Zheng, G., and Srikumar, V. (November, January 30). Deeplog: Anomaly detection and diagnosis from system logs through deep learning. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, Dallas, TX, USA.","DOI":"10.1145\/3133956.3134015"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Meng, W., Liu, Y., Zhu, S., Zhang, S., Pei, D., Liu, Y., Chen, Y., Zhang, R., Tao, S., and Sun, P. (2019, January 10\u201316). Loganomaly: Unsupervised detection of sequential and quantitative anomalies in unstructured logs. Proceedings of the International Joint Conference on Artificial Intelligence (IJCAI), Macao, China.","DOI":"10.24963\/ijcai.2019\/658"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Xu, W., Huang, L., Fox, A., Patterson, D., and Jordan, M. (2009, January 11\u201314). Largescale system problem detection by mining console logs. Proceedings of the SOSP, Big Sky, MT, USA.","DOI":"10.1109\/ICDM.2009.19"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Lin, Q., Zhang, H., Lou, J.G., Zhang, Y., and Chen, X. (2016, January 14\u201322). Log clustering based problem identification for online service systems. Proceedings of the 38th International Conference on Software Engineering Companion, Austin, TX, USA.","DOI":"10.1145\/2889160.2889232"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"He, S., Lin, Q., Lou, J.G., Zhang, H., Lyu, M.R., and Zhang, D. (2018, January 4\u20139). Identifying impactful service system problems via log analysis. Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Lake Buena Vista, FL, USA.","DOI":"10.1145\/3236024.3236083"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Zhang, X., Xu, Y., Lin, Q., Qiao, B., Dang, Y., Xie, C., Cheng, Q., Li, Z., Chen, J., and He, X. (2019, January 26\u201330). Robust log-based anomaly detection on unstable log data. Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Tallinn, Estonia.","DOI":"10.1145\/3338906.3338931"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Yang, L., Chen, J., Wang, Z., Wang, W., Jiang, J., Dong, X., and Zhang, W. (2021, January 25\u201328). Semi-supervised log-based anomaly detection via probabilistic label estimation. Proceedings of the IEEE\/ACM 43rd International Conference on Software Engineering (ICSE), Madrid, Spain.","DOI":"10.1109\/ICSE43902.2021.00130"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Ma, R., Pang, G., Chen, L., and Van Den Hengel, A. (2022, January 21\u201325). Deep graphlevel anomaly detection by glocal knowledge distillation. Proceedings of the Fifteenth ACM International Conference on Web Search and Data Mining, Tempe, AZ, USA.","DOI":"10.1145\/3488560.3498473"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Qiu, C., Kloft, M., Mandt, S., and Rudolph, M. (2022). Raising the bar in graph-level anomaly detection. arXiv.","DOI":"10.24963\/ijcai.2022\/305"},{"key":"ref_17","first-page":"24144","article-title":"Dual-discriminative graph neural network for imbalanced graph-level anomaly detection","volume":"35","author":"Zhang","year":"2022","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3533770","article-title":"Detecting anomalous graphs in labeled multi-graph databases","volume":"17","author":"Nguyen","year":"2023","journal-title":"ACM Trans. Knowl. Discov. Data"},{"key":"ref_19","unstructured":"Hamilton, W.L., Ying, Z., and Leskovec, J. (2017). Inductive representation learning on large graphs. Adv. Neural Inf. Process. Syst., 30."},{"key":"ref_20","unstructured":"Veli\u010dkovi\u0107, P., Cucurull, G., Casanova, A., Romero, A., Lio, P., and Bengio, Y. (2017). Graph attention networks. arXiv."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Shi, Y., Huang, Z., Feng, S., Zhong, H., Wang, W., and Sun, Y. (2021, January 19\u201327). Masked label prediction: Unified message passing model for semi-supervised classification. Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence (IJCAI), Montreal, QC, Canada.","DOI":"10.24963\/ijcai.2021\/214"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/2133360.2133363","article-title":"Isolation-based anomaly detection","volume":"6","author":"Liu","year":"2012","journal-title":"ACM Trans. Knowl. Discov. Data (TKDD)"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"He, P., Zhu, J., Zheng, Z., and Lyu, M.R. (2017, January 25\u201330). Drain: An online log parsing approach with fixed depth tree. Proceedings of the IEEE International Conference on Web Services (ICWS), Honolulu, HI, USA.","DOI":"10.1109\/ICWS.2017.13"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Oliner, A., and Stearley, J. (2007, January 25\u201328). What supercomputers say: A study of five system logs. Proceedings of the 37th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN\u201907), Edinburgh, UK.","DOI":"10.1109\/DSN.2007.103"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Zhu, J., He, S., Liu, J., He, P., Xie, Q., Zheng, Z., and Lyu, M.R. (2019, January 25\u201331). Tools and benchmarks for automated log parsing. Proceedings of the 2019 IEEE\/ACM 41st International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP), Montreal, QC, Canada.","DOI":"10.1109\/ICSE-SEIP.2019.00021"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Wang, F., Bundy, A., Li, X., Zhu, R., Mauceri, S., Xu, L., Wang, F., and Pan, Z.J. (2022). LEKG: A system for constructing knowledge graphs from log extraction. Proceedings of the 10th International Joint Conference on Knowledge Graphs, ACM.","DOI":"10.1145\/3502223.3502250"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Ekelhart, A., Ekaputra, F.J., and Kiesling, E. (2021). The slogert framework for automated log knowledge graph construction. European Semantic Web Conference, Springer International Publishing.","DOI":"10.1007\/978-3-030-77385-4_38"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Kurniawan, K., Ekelhart, A., Kiesling, E., Winkler, D., Quirchmayr, G., and Tjoa, A.M. (2021, January 17\u201320). Virtual knowledge graphs for federated log analysis. Proceedings of the 16th International Conference on Availability, Reliability and Security, Virtually.","DOI":"10.1145\/3465481.3465767"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Cui, L., Wu, Y., Liu, J., Yang, S., and Zhang, Y. (2021). Template-based named entity recognition using BART. arXiv.","DOI":"10.18653\/v1\/2021.findings-acl.161"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Reimers, N., and Gurevych, I. (2019). Sentence-bert: Sentence embeddings using siamese bert-networks. Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), Association for Computational Linguistics.","DOI":"10.18653\/v1\/D19-1410"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Li, Y., Yu, X., Liu, Y., Chen, H., and Liu, C. (2023, January 9\u201314). Uncertainty-aware bootstrap learning for joint extraction on distantly-supervised data. Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics, Toronto, ON, Canada.","DOI":"10.18653\/v1\/2023.acl-short.116"},{"key":"ref_32","unstructured":"Tong, Z., Liang, Y., Sun, C., Li, X., Rosenblum, D., and Lim, A. (2020, January 6\u201312). Digraph inception convolutional networks. Proceedings of the Advances in Neural Information Processing Systems, Virtually."},{"key":"ref_33","unstructured":"Gilmer, J., Schoenholz, S.S., Riley, P.F., Vinyals, O., and Dahl, G.E. (2017, January 6\u201311). Neural message passing for quantum chemistry. Proceedings of the International Conference on Machine Learning, Sydney, Australia."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Xu, W., Huang, L., Fox, A., Patterson, D., and Jordan, M.I. (2009, January 11\u201314). Detecting large-scale system problems by mining console logs. Proceedings of the ACM SIGOPS 22nd Symposium on Operating Systems Principles, Big Sky, MT, USA.","DOI":"10.1145\/1629575.1629587"},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"4119","DOI":"10.1109\/TNSM.2021.3125967","article-title":"Log sequence anomaly detection based on local information extraction and globally sparse transformer model","volume":"18","author":"Zhang","year":"2021","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"1475","DOI":"10.1109\/TCYB.2018.2804940","article-title":"Distributed online one-class support vector machine for anomaly detection over networks","volume":"49","author":"Miao","year":"2018","journal-title":"IEEE Trans. Cybern."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Zhang, C., Peng, X., Sha, C., Zhang, K., Fu, Z., Wu, X., Lin, Q., and Zhang, D. (2022, January 22\u201324). Deeptralog: Trace-log combined microservice anomaly detection through graph-based deep learning. Proceedings of the 44th International Conference on Software Engineering, Pittsburgh, PA, USA.","DOI":"10.1145\/3510003.3510180"},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Yang, H., Sun, D., Wang, Y., and Huang, W. (2024). DSGN: Log-based anomaly diagnosis with dynamic semantic gate networks. Inf. Sci., 680.","DOI":"10.1016\/j.ins.2024.121174"}],"container-title":["Computers"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-431X\/15\/5\/273\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,13]],"date-time":"2026-05-13T04:19:11Z","timestamp":1778645951000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-431X\/15\/5\/273"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,24]]},"references-count":38,"journal-issue":{"issue":"5","published-online":{"date-parts":[[2026,5]]}},"alternative-id":["computers15050273"],"URL":"https:\/\/doi.org\/10.3390\/computers15050273","relation":{},"ISSN":["2073-431X"],"issn-type":[{"value":"2073-431X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,4,24]]}}}