LogGCL: GCN-Augmented Structural Contrastive Learning for Unsupervised Log Anomaly Detection

With the rise of microservices and cloud-native architectures, system log volumes have exploded, and their semi-structured nature, temporal dependencies, and rich semantics challenge traditional anomaly detectors. We propose a graph-classification framework, LogGCL, that combines few-shot prompt learning with contrastive pretraining under multi-dimensional structural perturbations. A small set of annotated samples guides BERT-based field extraction to produce high-quality node attributes. Directed, weighted log-event graphs undergo perturbations—edge deletion, replacement, order shuffling, and field swapping—to form positive and negative pairs. A two-layer directed Graph Convolutional Networks(GCN) trained with an InfoNCE loss learns robust representations, followed by a lightweight linear classifier for end-to-end anomaly detection. On the HDFS, BGL, and Thunderbird datasets, LogGCL significantly outperforms existing methods, achieving F1-scores of 0.93, 0.96, and 0.93, respectively, which marks a clear improvement over the best baselines. The results demonstrate that integrating few-shot extraction with perturbation-driven contrastive learning is an effective solution for automated log-based monitoring in dynamic systems.