MeCoLog: Meta-contrastive learning for cross-system few-shot log-based anomaly detection

Abstract

System logs are widely used for monitoring system reliability and detecting abnormal behaviors in large-scale computing infrastructures. While deep learning has significantly advanced log anomaly detection, most existing methods are confined to in-domain scenarios, relying heavily on abundant system-specific historical data. Consequently, they struggle to monitor newly deployed systems where log data and anomaly labels are severely scarce. Achieving robust cross-system log anomaly detection remains a challenge due to inherent domain gaps, including completely different logging structures, continuously evolving templates and severe Out-Of-Vocabulary issues. To bridge these gaps, we propose MeCoLog, a Meta-Contrastive learning method for cross-system log anomaly detection. First, a Hybrid Parameter Embedding is introduced to encode type, value, and key information to handle diverse vocabularies. These embeddings are integrated into the model via a Gated Key Injection mechanism and Rotary Position Embedding. These allow the model to capture both event relevance and execution flow. Second, we design an Asymmetric Prototype Contrastive Learning objective. This method aligns normal behaviors across different systems while strictly isolating anomalies. Together, this design enables MeCoLog to achieve robust performance in few-shot scenarios. Extensive experiments on multiple public log datasets (HDFS, BGL, Thunderbird, Hadoop and AIT-LDS v2.0) demonstrate that MeCoLog consistently outperforms state-of-the-art baselines under few-shot cross-system settings, offering a robust and highly transferable solution for real-world log anomaly detection.