Log anomaly detection in modern distributed systems is challenging. Anomalous behaviors are rare. Manual labeling is expensive. Session boundaries are often set by fixed heuristics before model training. This fixed-boundary assumption is problematic because segmentation errors propagate into representation learning and cannot be corrected during optimization. To address this, this paper proposes BASN (Boundary-Aware Sessionization Network), a boundary-aware contrastive learning framework that jointly learns session boundaries and anomaly representations using a differentiable soft-reset mechanism. BASN does not treat sessionization as a separate step. Instead, it predicts boundary probabilities from event semantics and temporal gaps, then modulates end-to-end session-state updates. The session representations are optimized with self-supervised contrastive learning, enabling effective zero-shot anomaly detection and few-shot adaptation. Experiments on four benchmark datasets (BGL, HDFS, OpenStack, SSH) show strong zero-shot performance (area under the receiver operating characteristic curve, AUROC 0.935–0.975) and boundary alignment with expert-validated proxy segmentation (boundary F1 0.825–0.877). Comparative gains over baselines are reported in the article after bibliography correction, baseline verification, and expanded statistical analysis. BASN is also computationally efficient, requiring less than 10 ms per session on a Graphics Processing Unit (GPU) and less than 45 ms on a Central Processing Unit (CPU). This is compatible with real-time inference needs in the evaluated settings. However, cross-system transfer AUROC (0.735–0.812) remains below in-domain performance. Domain-specific adaptation is still needed for deployment in environments that differ greatly from the training domain.
Ailabouni et al. (Thu,) studied this question.