Single-system log anomaly detection

Log anomaly detection typically follows a four-stage pipeline: log collection, log parsing, feature extraction, and anomaly detection [2,3,19]. Raw log records encoding execution events are transformed by a log parser (e.g., Drain [7], Spell [20], or UniParser [21]) into structured templates by replacing variable fields with wildcards. The resulting template sequences are encoded into numerical representations, such as event count vectors or ordered key sequences grouped by windows [1,5], before being passed to the detection model. These models differ substantially in their supervision assumptions, spanning supervised approaches (e.g., LogRobust [9]), semi-supervised methods that model normal execution paths (e.g., DeepLog [5], LogAnomaly [6], LogBERT [8]), and unsupervised clustering techniques (e.g., LogCluster [22], NeuralLog [16]). Despite their efficacy, all three paradigms are fundamentally restricted to single-system settings and degrade substantially under cross-system deployment due to shifting logging behaviors [10–12].

To capture anomalies invisible to template-only configurations, a parallel line of work explicitly integrates parameter information into log representations. HitAnomaly [23] utilizes separate Transformer encoders for templates and parameters, while Chai et al. [24] preserve parameter semantics within a BERT framework. Similarly, LogFormer [25] injects character-level parameter encodings as scalar attention biases. Crucially, while these methods confirm the value of parameter-aware representations, they remain inherently tied to source-system vocabularies or apply biases uniformly without distinguishing template keywords from parameters. Furthermore, their multi-stage pipelines are not designed for the label-scarce, cross-system regime that MeCoLog targets.

Cross-system log anomaly detection

Cross-system log anomaly detection aims to deploy models on unseen target domains with minimal supervision by leveraging knowledge from source systems [10,12,13]. Existing strategies explore adversarial domain adaptation to align global feature distributions (LogTransfer [10]), unsupervised nearest-neighbor scoring (Han et al. [12]), structural graph Transformers (LogGT [11]), and episodic meta-learning for rapid adaptation (MetaLog [13]).

Despite these advancements, cross-system deployment faces a fundamental linguistic and structural gap driven by disparate logging libraries, template formats, and parameter distributions. Traditional parsing discards crucial system-agnostic operational semantics (e.g., numerical resource metrics or node identifiers) through wildcard substitution, eliminating anchors that could establish cross-system correspondence. Even operationally identical behaviors are expressed through entirely different structures. As quantified in Fig 2, while dense semantic encoders like SBERT [26] may suggest moderate proximity (0.62–0.75) via coarse geometric clustering of technical terms, strict lexical measures like the WordNet Lemma Jaccard similarity reveal near-total disjointedness (0.07–0.25). Models anchored to source-specific surface tokens lack the reliable lexical footing necessary to generalize, resulting in poor performance under domain shifts.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 2. Semantic and Lexical Decomposition of Template Vocabularies.

The figure compares cross-dataset similarity using three metrics: a) SBERT (thresholded, ): Measures semantic similarity by mapping templates into a dense vector space to capture related technical terms. b) WordNet Lemma Jaccard: Evaluates strict lexical overlap based on normalized word lemmas, highlighting the lack of shared linguistic base words. c) Combined: An integrated view of both semantic and lexical proximity, illustrating the fundamental “vocabulary gap” across different system environments.

https://doi.org/10.1371/journal.pone.0356907.g002

Furthermore, existing cross-system paradigms fail to account for the asymmetric geometry of normal versus anomalous behaviors under few-shot constraints. In real-world deployments, anomalies are severely underrepresented, often comprising less than one percent of log streams [3]. Consequently, a target support set of a few labeled instances cannot cover the full diversity of arbitrary system failures. As visualized in Fig 3, while normal behaviors form compact, stable clusters, anomalies exhibit a high degree of dispersion and unpredictable structural shapes. Contrastive objectives [14,27] that enforce uniform compactness across all classes are therefore ill-suited to this domain. While metric-based meta-learning networks [28,29] optimize for fast adaptation with sparse data, they must be coupled with an embedding space that respects this natural asymmetry. MeCoLog directly addresses these compounding limitations by fusing hybrid parameter encoding with an asymmetric contrastive learning objective within an episodic meta-learning framework.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 3. Dispersion of Raw data: Diversity and arbitrary shape of anomalies.

https://doi.org/10.1371/journal.pone.0356907.g003

Overview

We propose MeCoLog, a metric-based meta-learning method for cross-system log anomaly detection. The method addresses the two principal challenges of cross-system deployment: label scarcity in the target system and the domain gap between heterogeneous logging environments. The overall pipeline proceeds as follows. Raw log sequences are first parsed into structured representations consisting of a template and a set of typed parameters. For each log event, type-specific parameter embeddings are constructed and aggregated into a single parameter embedding. Template and parameter vectors are then fed jointly into a Transformer encoder, where parameter information is injected into the attention mechanism through a GKI mechanism. The encoder produces a sequence-level embedding that captures both template semantics and operational parameter context. These embeddings are optimized during meta-training on source systems via episodic sampling and an APCL. For deployment, a small labeled support set is collected from the target system, while a query set from the test suite is used to assess model performance. Fig 4 provides a detailed overview of this pipeline.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 4. Overview of the MeCoLog method.

https://doi.org/10.1371/journal.pone.0356907.g004

Parameter integration

Standard log parsers replace variable parameters with wildcards, discarding critical operational context such as resource identifiers, numerical values, system states, and path information [7]. This also creates cross-system incompatibility because value vocabularies differ between systems. We address both issues by constructing type-specific parameter embeddings that encode operational semantics in a domain-agnostic manner. These embeddings are then injected into the Transformer encoder jointly with relative positional information. Fig 5 illustrates the overall architecture for this integration. It shows how the parameter vectors are fused with template embeddings and relative positional information within the Transformer encoder.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 5. The Parameter-Integrated Transformer Block. The diagram illustrates our proposed Hybrid Parameter Encoder and the GKI process.

These components, combined with the integrated RoPE, enable the model to modulate inter-event attention based on specific parameter values while preserving relative positional context across heterogeneous log sequences.

https://doi.org/10.1371/journal.pone.0356907.g005

Hybrid parameters embedding

For each log event, we extract parameters using regular expressions and represent them as tuples , where k is the key, v is the value, and is the type. The type is inferred from predefined patterns and belongs to the set . If a parameter appears in explicit key-value form (e.g., user = root), the key is extracted directly; otherwise, a positional key is assigned according to its order in the line. The set of positional keys is fixed and shared across all datasets.

Value embeddings are computed differently according to type to preserve operational semantics without relying on dataset-specific vocabularies. For categorical strings (), we apply a character-level CNN encoder: the value is tokenized into characters, embedded, passed through 1D convolution with ReLU activation, and max-pooled. For paths, a normalization step preserves structural delimiters while replacing volatile numeric or hexadecimal substrings with shared placeholders (e.g., ). Numerical values () are projected using a log-scaled transformation that preserves magnitude without allowing large values to dominate. High-cardinality identifiers () contribute only through their type embedding (). IP addresses and hexadecimal tokens are instance-specific identifiers that vary arbitrarily across systems and log lines; encoding their values would introduce system-specific noise into the representation rather than transferable semantics. The specific encoding workflows for these diverse parameter types are illustrated in Fig 6. Formally:

(1)

where and are learnable parameters, and is the sign function that preserves the algebraic direction of the value.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 6. Specialized encoding pipelines for different parameter types.

https://doi.org/10.1371/journal.pone.0356907.g006

MeCoLog employs an additive factorization strategy to construct parameter embeddings, utilizing learnable lookup tables for keys and types to ensure cross-system stability. Keys and types are embedded with small learnable lookup tables that depend only on explicit field names or positional identifiers. Unseen explicit keys at meta-testing are mapped to a shared token, ensuring the key vocabulary remains stable across systems. Let and denote the embeddings for keys and types, respectively, retrieved from learnable lookup tables. The total parameter embedding for a single tuple is formed through additive factorization:

(2)

This factorization lets key semantics, structural type, and value information contribute independently to the downstream attention computation. For an event with M parameters, the individual parameter embeddings are summed to obtain a single permutation-invariant parameter vector:

(3)

Integrated parameter and sequence information

Each log event therefore carries two representations: a template semantic embedding produced by Sentence-BERT [26], and its parameter vector . A sequence of L events, prepended with a learnable token, yields template and parameter matrices . The SBERT model is kept frozen during meta-training to serve as a robust and general-purpose feature extractor. This design follows the large-small model collaboration paradigm [30], where a large pretrained model provides semantic grounding while a lightweight module handles task-specific adaptation. This prevents the model from overfitting to the specific vocabulary of the source systems and ensures that the learned template embeddings remain transferable across heterogeneous logging environments.

MeCoLog modulates inter-event relevance by injecting the parameter matrix directly into the key projection of each Transformer self-attention layer. This design is based on the role of the key in determining which events receive more attention, while the query and value are responsible for information retrieval. By augmenting the key with parameter embeddings, the model lets the operational context of each log event adjust its influence on the sequence representation. The core semantic information extracted per event remains unaltered. Concretely, for each attention head h, the query and value projections are derived from the template embeddings in the standard manner, while the key is computed as:

(4)

where are the template and parameter matrices, is the standard key projection matrix, and are learnable projection matrices for the gating and parameter branches respectively, denotes the sigmoid function, LN denotes layer normalization, and ⊙ is the element-wise product. The sigmoid gate selectively scales the contribution of each parameter embedding before it enters the key, suppressing high-cardinality noise while allowing semantically meaningful parameters to modulate inter-event similarity.

MeCoLog incorporates RoPE [18] to capture the relative temporal dependencies between log events, which are more critical for anomaly detection than absolute positioning. Standard positional encodings often conflate positional and semantic signals by adding fixed offsets, making attention scores a function of absolute indices rather than relative distances. This is insufficient for log sequences, where anomalous executions typically manifest as violated ordering constraints or unexpected temporal gaps, signals that are defined by the distance between events rather than their specific positions in a window. By applying RoPE directly to the query and augmented key projections, the model encodes position by rotating vectors in a multi-dimensional complex space. This ensures that the dot product between a query at position m and a key at position n depends solely on the relative offset , allowing the Transformer to focus on the sequential flow of the system state.

(5)

are the block-diagonal rotation matrices applied at positions m and n respectively, and denotes the resulting attention score, which depends only on the relative offset rather than absolute positions. This means attention scores between any two log events encode how far apart they are in the execution flow, independent of where the window starts. As a desirable consequence, attention naturally decays with increasing event distance [18]. Nearby events receive higher influence, while long-range dependencies can still be captured when necessary.

The final query and key projections entering the attention computation are:

(6)

(7)

where denotes the position-wise RoPE rotation applied element-wise to each row according to the event’s index in the sequence. The attention score between events at positions m and n then becomes:

(8)

where is the key dimensionality used as a scaling factor to stabilize gradients, and the score depends on both the semantic and parameter content of the two events (encoded in and via GKI) and their relative position (encoded by the rotation).

The integration of GKI and RoPE provides both content and order information. While GKI enriches the semantics of each key by fusing template evidence with parameter context, RoPE applies a position-dependent orthogonal transformation to these enriched vectors. Because RoPE is norm-preserving, the magnitude-based gating effects of GKI remain invariant under rotation. The integrity of parameter-driven attention modulation is therefore maintained. This composition allows the model to simultaneously evaluate the operational significance of an event (via GKI) and its relative temporal distance (via RoPE) without mutual interference.

Together, GKI encodes the operational context of each individual event, while RoPE makes inter-event attention sensitive to sequential distance. This enables the encoder to detect both semantic anomalies (wrong parameter values) and sequential anomalies (correct events in a wrong order) within the same unified attention computation.

The full encoder stack aggregates global sequence context with both parameter awareness and relative position sensitivity. The final sequence embedding is taken from the output position and passed to the APCL objective during meta-training and to the prototype inference procedure at meta-testing.

Episodic meta-learning

We formulate cross-system log anomaly detection as a few-shot metric-learning problem under the episodic meta-learning paradigm [28,29]. Training tasks are sampled from a distribution of episodic tasks constructed from the source system. Each task is a N-way K-shot episode: N classes (normal and one or many anomaly classes), each represented by K support samples. Concretely, each episode consists of:

• A support set , where . This simulates the few-shot calibration available at deployment. and are the support sets of normal and anomalous sequences respectively
• A query set , drawn from the same system but disjoint from , used to compute the training loss.

The value of K is varied across experiments to assess sensitivity to support set size. During meta-training the model parameters are updated so that performance on improves after conditioning on . During meta-testing on a new target system, only a small labeled support set is available; the model reuses the transferable embedding learned from source systems and calibrates the detection boundary on the fly without any retraining.

The episodic procedure directly mirrors the target deployment scenario. By training on diverse episodic tasks sampled from the source system, the model learns a general adaptation strategy rather than source-specific patterns. This means no distributional alignment between source and target systems is assumed or required. The model learns how to adapt, not what the target looks like.

Asymmetric prototype contrastive loss

Standard supervised contrastive objectives treat all classes symmetrically, which is appropriate only when all classes are equally compact. Log anomaly detection violates this assumption: normal behaviors are semantically stable and form compact clusters, whereas anomalies arise from diverse, unpredictable causes. A symmetric loss imposes a false structural equivalence on these distinct data geometries.

We propose a loss that reflects this asymmetry directly. Normal queries use standard prototype cross-entropy to tighten the normal cluster. Anomaly queries use a margin-augmented variant that concentrates gradients on “hard” anomalies, namely those closest to the normal prototype. It does not impose a compactness constraint on anomaly embeddings. Our Asymmetric Prototype Contrastive Loss (APCL) inflates the normal prototype similarity for anomaly queries using an adaptive margin during training.

For each episode, both class prototypes are computed from the support set as equations below. All embeddings are L2-normalized onto the unit hypersphere before computing similarities:

(9)

(10)

where is the sequence encoder parameterized by , and are the resulting class prototypes.

To separate anomalies from normal samples, we propose the Adaptive Margin Mechanism, which dynamically penalizes anomalies residing near the normal cluster. The difficulty of an anomaly query is quantified by its proximity to :

(11)

This formulation ensures that the margin grows proportionally to the proximity for hard anomalies, while remaining zero for anomalies already positioned in the opposite hemisphere. For a query sample with label , let denote the scaled cosine similarity . The margin-adjusted similarity to the normal prototype is defined as:

(12)

The APCL loss treats the normal and anomalous queries asymmetrically by inflating the denominator for anomalies. The unified objective for a single query is expressed as:

(13)

Finally, the total loss for a training episode is the average over the query set :

(14)

The APCL design shapes the embedding space by encouraging normal samples to form a compact cluster while allowing anomalies to remain diverse across different system contexts. Anomaly queries are attracted toward an episode-local anomaly prototype through the numerator of Eq. 13. However, APCL removes the symmetric same-class pairwise compaction of standard contrastive objectives, and the anomaly prototype is recomputed per episode from varying anomaly compositions. No fixed global anomaly center therefore exists, and the adaptive margin concentrates the gradient on separating hard anomalies from the normal prototype rather than on compressing the anomaly class. This design links training more closely to inference, since the adaptive margin assigns larger penalties to anomalies with higher inference risk. As a result, training focuses more on hard anomalies, namely those with low , which are more likely to be confused with normal samples at test time. This helps make the inference rule more robust, without requiring manual threshold tuning or F1-based grid search.

Dataset

We evaluate the performance of MeCoLog using four widely recognized benchmark datasets: HDFS [1], BGL [31], Thunderbird [31], and Hadoop [22]. Each dataset comprises raw log lines labeled as either normal or anomalous. We process all datasets through a standardized pipeline of log parsing, template extraction, and sequence construction to ensure a fair and consistent comparison across all evaluated methods. For the HDFS dataset, we employ session-based grouping via BlockID, whereas Hadoop, BGL and Thunderbird are processed using a sliding window approach with a window size and step size both set to 20. Each system is split into training and testing partitions before any cross-domain experiment, with parameter vocabularies fit on the training partition only. All datasets use an 80/20 train/test split. For BGL and Thunderbird, a chronological split is used to preserve temporal ordering. For HDFS and Hadoop, the split is performed randomly at the session/block level. For cross-domain evaluation, MeCoLog meta-trains on the entire source training partition and evaluates exclusively on the target test partition. The few-shot support set at inference is drawn from the target test pool. Source test data and target training data are never used for model optimization.

The preprocessing details and statistics of HDFS, BGL, Hadoop and Thunderbird are summarized in Table 1. Besides sequence statistics, the table reports three structural characteristics: Unique Templates, the number of distinct log event types after parsing; Template Vocab, the number of unique tokens across all templates, reflecting lexical diversity; and Effective Templates, which measures the effective diversity of template usage by accounting for their frequency distribution. Unlike raw template count, this metric better captures structural complexity. Together, these characteristics quantify the structural gap between source and target systems, providing insight into the challenges of cross-system transfer.

Download:

• PNG
  larger image
• TIFF
  original image

Table 1. Statistical summary of benchmark datasets.

https://doi.org/10.1371/journal.pone.0356907.t001

To further assess the model’s robustness against diverse failure modes, we evaluate MeCoLog on the AIT Log Data Set v2.0 [32], which aggregates logs from eight different enterprises and covers various cyber-attack categories. In this study, we focus specifically on the access.log files from two enterprises, russellmitchell and santos, to examine the model’s performance in real-world server environments. AIT-LDS v2.0 uses a stratified 65/35 split to ensure that minority attack categories are represented in both partitions.

For sequence construction of AIT-LDS v2.0, we employ a sliding window approach with a window size of 20 and a smaller step size of 4 to ensure high coverage of sequential behaviors. We adopt a hybrid labeling strategy to categorize these sequences: generally, a sequence is labeled according to the majority attack type present within the window. However, to prioritize the detection of critical threats, any sequence containing at least one log line associated with severe attacks, such as webshell upload or privilege escalation, is automatically flagged as an anomaly of that specific type, regardless of the distribution of other labels. The severity override changes the fine-grained label of only 44 of 4,489 windows (0.98%). Crucially, all experiments on this dataset are formulated as binary anomaly detection, meaning each window is ultimately classified as either normal or anomalous. The fine-grained attack-type annotations are used solely for dataset characterization (Table 2) rather than prediction targets. Consequently, the reported metrics are identical under both the hybrid rule and a pure majority-vote rule. This override reflects security monitoring practice, where a window containing a critical event must not be labeled normal by majority, rather than a performance consideration.

Download:

• PNG
  larger image
• TIFF
  original image

Table 2. Detailed class distribution of the AIT-LDS v2.0 dataset, sorted by attack frequency.

https://doi.org/10.1371/journal.pone.0356907.t002

For AIT-LDS v2.0, the support and query partitions are disjoint by construction, with the query set defined as the target test pool excluding the sampled support windows. For all other datasets, the step size equals the window size, so windows are non-overlapping. Combined with the cross-enterprise isolation between source training and target evaluation, no window is shared across the training, support, and query partitions.

During episodic meta-training, especially for multi-attack datasets like AIT-LDS v2.0, each episode is formed by sampling normal sequences and a diverse set of anomalous sequences spanning different attack categories. While the normal prototype () is computed to form a compact cluster, the anomalous instances are treated via an asymmetric objective.

Implementation details

Regarding the MeCoLog implementation, we use a parameter-aware Transformer encoder over fixed, precomputed 768-dimensional template embeddings. The architecture employs 1 encoder layer with 8 attention heads, RoPE positional encoding, and a GELU feed-forward sublayer of size 3072. Log-specific attributes are encoded by a type-aware parameter encoder and injected into attention through gated additive key refinement before the softmax layer.

For meta-training, we adopt episodic learning with a default 20-shot per class support set (normal and anomalous) and 10 query samples per class per episode. The APCL objective is optimized with a temperature using Adam (learning rate , weight decay 0) for 2000 default episodes. During inference, target domain test samples are scored via prototype-based comparison against the normal and anomalous support prototypes.

Log parsing is executed using Drain (similarity threshold 0.5, depth 4), with frozen template embeddings generated by the SBERT distilbert-base-nli-mean-tokens variant via mean pooling. All reported results are averaged over 5 independent runs. To ensure a fair comparison, the train/test data partition remains fixed under a single seed, while model initialization, episodic sampling, and meta-test support/query partitioning are varied across runs using five distinct seeds applied identically to all baselines. The source code is archived on Zenodo at https://doi.org/10.5281/zenodo.20487208. All experiments are conducted on an Ubuntu 22.04.3 LTS environment equipped with an Intel Xeon Gold 6240 CPU, an NVIDIA Quadro RTX 5000 GPU (16GB VRAM), and GPU Driver version 550.120.

Baselines

To evaluate the effectiveness of MeCoLog, we compare it against two distinct groups of baseline models, ranging from classical single-system architectures to state-of-the-art cross-system methods.

Single-System Log Anomaly Detection Baselines: These models serve as benchmarks for assessing the fundamental discriminative power of log representations within a single domain:

• DeepLog [5]: A semi-supervised method using LSTMs to model system execution sequences as a language modeling task, flagging unexpected log key transitions.
• LogAnomaly [6]: An extension incorporating Word2Vec semantics to simultaneously capture sequential order and quantitative count-based deviations.
• LogRobust [9]: A supervised Bi-LSTM with attention engineered to handle template instability and noisy labels in real-world logs.

Cross-System and Few-Shot Learning Baselines: These methods explicitly address the challenges of domain shift and label scarcity in target systems:

• LogTransfer [10]: A supervised transfer learning approach that pre-trains an encoder on source data and fine-tunes the classifier on the target system.
• MetaLog [13]: A cross-system framework using a meta-learning strategy over source tasks to enable rapid target adaptation given a few-shot support set.
• LogTAD [12]: An unsupervised domain adaptation method that learns a unified representation space and measures distance from a global normal distribution.
• LogFormer [25]: A pre-training and adapter-based Transformer with character-level parameter encodings, whose two-stage pipeline requires labeled data from both domains.

All baselines utilize their originally designed feature representations and published hyperparameter configurations, as reliable re-tuning is impractical given the strict few-shot budget of the target system. The target few-shot support set (fixed at K = 20 per class, sharing identical query splits with MeCoLog) is applied via each baseline’s native adaptation mechanism. For semi-supervised models (DeepLog, LogAnomaly), which lack mechanisms to train on anomalies, support anomalies are used solely to calibrate the decision threshold. For supervised baselines (LogRobust, LogTransfer), the support samples are integrated into their respective training or fine-tuning procedures to ensure a consistent target-label budget across all evaluated methods.

Evaluation metrics

Log anomaly detection is inherently class-imbalanced, since anomalous sequences constitute only a small fraction of the total data. Relying solely on accuracy can therefore be misleading. We therefore evaluate MeCoLog using the following comprehensive suite of metrics:

• Precision, Recall, and F1-score: We report the macro-averaged Precision and Recall to assess the model’s accuracy and completeness in identifying anomalies. The F1-score, calculated as the harmonic mean of Precision and Recall, serves as our primary metric for performance comparison.
• ROC-AUC: We include the Area Under the Receiver Operating Characteristic curve to measure the model’s ability to distinguish between normal and anomalous classes across various decision boundaries.

Results and discussion

We evaluate the cross-system adaptability of MeCoLog through one-to-one () transfer experiments across all six representative transfer pairs within the BGL, HDFS, Thunderbird and Hadoop benchmark suite. As detailed in Table 3, our evaluation focuses on pairs with shared architectural characteristics. These include the distributed system environments of HDFS Hadoop and the supercomputing contexts of BGL Thunderbird. We also include a heterogeneous mixture pair (HDFS BGL) to test the model’s robustness under significant domain shifts. This structured comparison allows us to assess whether semantic and structural patterns learned from a source system can be effectively projected onto a previously unseen target environment with minimal supervision.

Download:

• PNG
  larger image
• TIFF
  original image

Table 3. Cross-system log anomaly detection performance across six one-to-one transfer pairs on four datasets (HDFS, BGL, Thunderbird and Hadoop). Each group reports AUC, Precision, Recall, and F1-score for eight methods under a 20-shot support set.

https://doi.org/10.1371/journal.pone.0356907.t003

Table 3 presents the performance of MeCoLog compared to various baselines across six different cross-system transfer pairs. Overall, MeCoLog demonstrates superior adaptability and robustness, consistently achieving the highest F1-score and AUC in the majority of scenarios. In “homogeneous” transfer tasks where systems share similar architectures, such as HDFS Hadoop or BGL Thunderbird, MeCoLog maintains high precision and recall. It often surpasses strong baselines such as MetaLog and LogRobust. This indicates that our model effectively captures the underlying semantic and structural invariants common to similar system types. The HDFS BGL and BGL HDFS tasks involve significant domain shifts between different system categories. In these tasks, MeCoLog clearly outperforms the other methods in AUC, reaching 0.954 and 0.963 respectively. This confirms that the integration of GKI and APCL allows the model to generalize well even when the target system’s vocabulary and event distributions differ substantially from the source. Fig 7 shows the standard deviation of performance across multiple runs in the HDFS-to-BGL scenario, indicating the stability of the proposed MeCoLog method.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 7. Error bar plot for the HDFS-to-BGL transfer scenario.

https://doi.org/10.1371/journal.pone.0356907.g007

In several transfer scenarios, MeCoLog achieves the highest AUC while not leading on F1-score. This stems directly from the inference mechanism: MeCoLog assigns each query to its nearest prototype without any tunable decision threshold. Because anomalies in the target system are diverse and dispersed, some anomalous queries lie far from the anomaly prototype computed from the small support set and are assigned to the normal class. This lowers recall while precision remains high, producing a conservative operating point. AUC, as a threshold-free metric, is unaffected by this fixed operating point and more faithfully captures the model’s discriminative capability across all operating points. It is therefore our primary evaluation criterion.

To assess the risk of negative transfer arising from different logging semantics, we observe that the most prominent pattern is the correlation between cross-system semantic distance and the transfer performance gap. Specifically, when the combined similarity falls below a critical threshold, MetaLog suffers from severe representation collapse, whereas MeCoLog exhibits distance-agnostic robustness. The source domain complexity also shows a clear trend. High source diversity exacerbates embedding space dilution in traditional methods, whereas MeCoLog abstracts it into generalized knowledge. This robustness is attributable to SBERT’s vocabulary-agnostic semantic grounding and CharCNN’s character-level OOV handling. As a result, MeCoLog exhibits no instance of negative transfer across all evaluated pairs.

To further investigate the discriminative power of MeCoLog, we visualize the log sequence representations in the source systems across different training stages and ablation variants using t-SNE. As illustrated in Fig 8, there is a stark contrast between the initial feature distribution and the optimized embedding spaces. Initially (), normal and anomalous sequences are heavily overlapped, making boundary detection challenging. When trained under the MeCoLog variant without margin (), the model begins to separate the spaces, yet several hard anomalies remain loosely bound to the normal domain. Under the full APCL formulation (), these hard anomalies are systematically displaced. This produces a well-separated normal cluster and a cleaner decision boundary. At the same time, the overall dispersion of anomalies is preserved compared to the no-margin version. This optimal separation is particularly pronounced in the Thunderbird dataset (a₃), where normal logs are compressed into a dense cluster while anomalies are pushed to the periphery. Furthermore, the visualization reveals the intrinsic diversity of abnormal behaviors; instead of forming a single cluster, the anomalies are distributed across multiple sub-regions. This distribution reflects the model’s ability to capture various attack categories and arbitrary system failures without collapsing them into a single representation. It validates the effectiveness of the gated injection and the contrastive loss in preserving semantic richness.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 8. Log sequence representation before and after training phase for Thunderbird, HDFS and BGL dataset.

https://doi.org/10.1371/journal.pone.0356907.g008

To quantify this preserved dispersion beyond visual inspection, we measure intra-class dispersion of held-out embeddings using the mean pairwise cosine distance within each class. Under the full APCL, the dispersion among anomalies is 3.3–6.4 times larger than under a symmetric SupCon objective across the three source systems, while inter-class separation is preserved. This confirms that the multi-region structure observed in Fig 8 is not a visualization artifact: APCL avoids homogeneous anomaly compactness while still enabling prototype-based detection.

Table 4 shows the results of different methods when evaluated on the AIT-LDS v2.0 dataset. Overall, MeCoLog demonstrates exceptional performance on the AIT-LDS v2.0 dataset, establishing competitive state-of-the-art performance in cross-enterprise scenarios. Baseline methods often struggle with the diverse attack vectors and varying log distributions between different server environments. In contrast, MeCoLog maintains remarkable stability, with F1-scores and AUC values consistently exceeding 0.98. In the Russell Mitchell Santos transfer task, MeCoLog achieves an F1-score of 0.989 and an AUC of 0.996, significantly outperforming competitive baselines such as MetaLog (0.946 F1) and LogRobust (0.901 F1). Similarly, in the reverse scenario (Santos Russell Mitchell), the model reaches near-perfect Precision (0.997) and Recall (0.991). The performance gap is most evident when compared to traditional deep learning methods like DeepLog and LogAnomaly, which only manage AUC scores between 0.65 and 0.75. These results indicate that APCL effectively handles the diverse attack composition of the AIT dataset. It successfully distinguishes rare, sophisticated threats, such as webshell uploads and escalations, from high-volume normal server traffic.

Download:

• PNG
  larger image
• TIFF
  original image

Table 4. Performance comparison on the AIT-LDS v2.0 dataset across two cross-enterprise transfer scenarios, under the binary anomaly detection formulation.

https://doi.org/10.1371/journal.pone.0356907.t004

The near-perfect performance on AIT-LDS v2.0 stems from two factors. First, our cross-system evaluation trains and tests on distinct enterprises with completely isolated data partitions, eliminating any risk of data leakage from the sliding-window construction. Second, the task is framed as binary anomaly detection, where the model easily separates normal traffic from highly distinctive scanner signatures. Consequently, the high metrics reflect successful normal-versus-anomaly isolation rather than fine-grained multi-class attack attribution (e.g., identifying Escalate or Webshell Cmd), which remains a direction for future work. Fig 9 confirms this: only 3 false negatives out of 666 anomalies and 2 false positives out of 51 normal sequences are observed across both transfer directions.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 9. Binary confusion matrices on AIT-LDS v2.0, from random single run.

https://doi.org/10.1371/journal.pone.0356907.g009

Few-shot sensitivity

Fig 10 illustrates the sensitivity of MeCoLog to the number of K-shot support samples across two representative cross-system scenarios. Overall, the model exhibits remarkable stability even with an extremely limited supervision budget. In the HDFS BGL task, we observe a significant performance leap when increasing K from 10 to 20, where the F1-score stabilizes around 0.89, suggesting that 20 samples provide sufficient structural context for the target system. Similarly, for the Thunderbird BGL scenario, the AUC shows a steady upward trend, reaching its peak at K = 50. This sustained high performance across different K values confirms that MeCoLog’s asymmetric contrastive learning effectively leverages few-shot samples to align source-target representations without requiring exhaustive labeling.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 10. Sensitivity analysis of the number of K-shot samples. Bars indicate F1-score (left axis) while the line indicates AUC (right axis).

https://doi.org/10.1371/journal.pone.0356907.g010

Ablation studies

Table 5 illustrates the performance impact of each proposed component within the MeCoLog method across two cross-system transfer scenarios. The Baseline in this table refers to MeCoLog without Parameter Integration, RoPE, or APCL, where the contrastive objective is replaced by a standard Prototypical Network (PN) loss. Overall, the results indicate a consistent performance degradation whenever a core module is removed. This confirms that each component plays a synergistic role in enhancing the model’s robustness and transferability.

Download:

• PNG
  larger image
• TIFF
  original image

Table 5. Ablation study: Contribution of each proposed component for MeCoLog.

https://doi.org/10.1371/journal.pone.0356907.t005

To further investigate the contribution of the GKI mechanism, we implement two alternative fusion strategies that replace the gated formulation in Eq. (4) while keeping all other components identical.

• Additive fusion: adds the parameter projection directly to the base key without a gate: (15)
• Concat fusion: concatenates the base key and parameter projection, then applies a learned compression map to restore key dimensionality: (16)

Unlike GKI, neither variant can input-dependently attenuate the parameter contribution based on its content.

The removal of RoPE resulted in the most significant drop in F1-score for the HDFS BGL task (falling from 0.890 to 0.772). This trend suggests that capturing relative temporal dependencies is important for distinguishing anomalous patterns in long-sequence distributed logs. Furthermore, the exclusion of Parameter Integration (w/o Parameter Integration) led to a noticeable decline in Precision, highlighting the importance of dynamic parameters in disambiguating log messages that represent different operational states.

To further disentangle the contribution of APCL, we evaluate two degraded variants of the loss function. MeCoLog w/ APCL (no margin) retains the APCL objective but removes the margin term for anomaly samples. MeCoLog w/ APCL (fixed margin) preserves the asymmetric contrastive structure but substitutes the adaptive margin with a fixed scalar. This removes the model’s ability to adjust decision boundaries based on inter-class distance. The performance gap between these variants and the full model confirms that both the contrastive asymmetry and the adaptive margin mechanism are necessary. Finally, replacing our contrastive strategy with SCL led to a decrease in AUC across both scenarios. This validates that MeCoLog’s asymmetric optimization maintains high discriminative power.

The fusion ablation results confirm that GKI outperforms both alternatives across both transfer scenarios. On HDFSBGL, additive fusion achieves an F1 of 0.886 and concat fusion achieves 0.873, both below the full model (0.890). On ThunderbirdBGL, the same ordering holds (0.863 and 0.871 versus 0.886). The performance difference between additive fusion and GKI is modest in absolute terms but consistent across scenarios. This suggests that the content-dependent gate is the primary source of GKI’s contribution rather than the mere presence of a parameter pathway. Additive fusion always injects the full parameter signal regardless of its quality, whereas GKI can selectively suppress noisy embeddings such as those derived from IP addresses or hexadecimal identifiers on a per-event basis.

Hyperparameter sensitivity

In this section, we evaluate the impact of the temperature hyperparameter on the model’s discriminative performance. The temperature parameter plays a critical role in contrastive learning by controlling the “hardness” of the distribution over negative samples. We conduct a grid sweep with across two representative cross-system transfer pairs: HDFS BGL and Thunderbird BGL. The results are illustrated in Fig 11.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 11. Effect of the temperature parameter on AUC and F1 score under two cross-system scenarios.

https://doi.org/10.1371/journal.pone.0356907.g011

As shown in the figure, both the F1-score and AUC exhibit a high sensitivity to the choice of . We observe that lower temperature values () yield the best results, with performance peaking at approximately . Specifically, in the HDFS BGL scenario, the F1-score reaches its maximum of 0.886 at , while the AUC remains robust at 0.946. However, as increases beyond 0.2, there is a sharp decline in detection accuracy, particularly in the F1-score which drops significantly to approximately 0.75–0.77 at .

This trend can be explained by the fact that a smaller temperature encourages the model to focus more on the most difficult negative samples (hard negatives), leading to a more compact and well-separated representation space. Conversely, a larger tends to smooth the similarity distribution, causing the model to treat all samples equally and losing its ability to distinguish subtle anomalies from normal operational patterns. These findings suggest that a sharper contrastive distribution is essential for maintaining high precision in cross-system anomaly detection tasks.

Efficiency analysis

The theoretical complexity of MeCoLog remains competitive with standard Transformer architectures while incorporating rich, multi-modal log context. The Hybrid Parameter Integration layer operates with a complexity of , where L is the sequence length, M is the number of parameters per log, and represents the character-level convolutional filter operations. Since M is typically a small constant, this stage scales linearly with the input size. The core Gated Transformer Encoder maintains the complexity of self-attention. The Gated Key Injection mechanism uses element-wise operations and linear projections, which do not alter the model’s asymptotic growth. Finally, the Prototypical Inference phase is highly efficient. It requires only a single forward pass to generate embeddings and an operation to compute the normal prototype from a support set of size K. Consequently, MeCoLog achieves superior detection capabilities without introducing the quadratic bottlenecks often associated with heavy cross-attention or fine-tuning procedures.

As shown in Table 6, all methods are measured under identical hardware and batch size (batch size = 1, sequence length = 20) on the same machine. For MeCoLog, the reported Inference Latency corresponds to the forward pass of the parameter-integrated Transformer encoder, including the CharCNN parameter branch. Parameter values are instance-specific and must be encoded at inference time. It excludes SBERT template encoding. SBERT is precomputed and cached as a frozen, shared feature extractor, and its output depends only on the log template rather than the specific instance.

Download:

• PNG
  larger image
• TIFF
  original image

Table 6. Efficiency comparison of MeCoLog and baselines on the AIT-LDS cross-system scenarios. Each range reports RussellmitchellSantos and SantosRussellmitchell. GPU memory is the peak CUDA reserved memory unless otherwise stated. GPU throughput is the batched model-only throughput measured under identical hardware.

https://doi.org/10.1371/journal.pone.0356907.t006

MeCoLog demonstrates a favorable balance between effectiveness and computational cost. Its training time is substantially lower than most conventional and transformer-based baselines and remains comparable to other meta-learning approaches. Although MeCoLog does not achieve the lowest inference latency, its runtime remains practical given its superior detection performance. In terms of GPU memory, MeCoLog requires a moderate amount of resources. Its ablation variants exhibit identical memory consumption, which indicates that Parameter Integration and RoPE introduce negligible overhead. The higher inference latency relative to lightweight baselines such as LogRobust (0.056–0.061s) is directly attributable to model capacity. MeCoLog’s 8.34M parameters, driven by the GKI mechanism, the CharCNN parameter encoder, and multi-head attention, provide richer representational capacity at the cost of higher per-sample latency. This remains practical for log monitoring deployments, which are not typically sub-millisecond latency-critical. Overall, despite having the largest parameter count among the evaluated methods, MeCoLog maintains efficient training and inference characteristics while providing strong cross-system generalization capability.

The throughput column contextualizes the per-sample latency. Under batched operation, MeCoLog sustains approximately 1,800 windows per second, within the same order of magnitude as LogFormer (approximately 2,300 win/s). LogFormer’s slightly higher throughput reflects the absence of the parameter encoder and GKI path. This corresponds to over 150 million windows per day on a single GPU. The batch-1 latency in the Inference Latency column therefore does not constrain realistic monitoring deployments.