KDLog: a selective knowledge distillation approach for sequential log anomaly detection
Year: 2025
Type: article
Abstract: Log anomaly detection is a critical task for ensuring the reliability of complex systems. However, existing methods often suffer from poor adaptability and substantial retraining overhead as log data evolve. This paper introduces a novel framework called KDLog, a knowledge-distillation-based approach that enables accurate and efficient log anomaly detection in dynamic environments. KDLog employs a two-stage selective-distillation mechanism, in which a lightweight student model is trained using the high-confidence outputs generated by a teacher model, effectively preventing negative knowledge transfer. Compared with state-of-the-art methods, KDLog improves overall accuracy by 4.5%, F1-score by 4.3%, and recall by 3.3% on average across real-world datasets (HDFS and BGL). Moreover, it reduces model update time by 60–78% and achieves a smaller model size, by up to 50%, compared with deep learning baselines such as DeepLog and LogAnomaly. Statistical significance tests confirm the robustness of these improvements. Unlike prior methods, KDLog also demonstrates strong resilience to unseen log patterns, with less than a 4% performance drop under simulated log-template drift. These gains make KDLog a scalable and practical solution for real-time anomaly detection, effectively bridging the gap between high-performance learning and operational efficiency in production environments.
Source: Egyptian Informatics Journal
Authors: Hailong Cheng, Shi Ying, Xiaoyu Duan, Wanli Yuan
Institutions: Wuhan University, Zhengzhou University of Light Industry
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $1,200
Awards: G2650629966, G3604779899
OpenAlex ID: W7117361639