Abstract: Log anomaly detection plays a crucial role in the field of cybersecurity, yet existing methods still face significant challenges. Supervised learning approaches depend on large amounts of labeled data, making the annotation process timeconsuming and costly. Although unsupervised learning methods do not require labeled data, they struggle to effectively extract key features in complex log environments, which negatively impacts detection performance. To address these issues, this paper proposes a novel knowledge distillation approachcollaborative learningand introduces a log anomaly detection model based on this approach, CoLogGNN. The model first converts log data into a directed graph to comprehensively preserve the structural relationships between logs. During the early stages of training, CoLogGNN performs unsupervised learning on normal samples to explore the intrinsic structure of logs. In the mixedsample training phase, the graph attention network and the graph convolution module collaborate with each other and guide one another. When the graph attention network excels at processing certain samples, it transfers key knowledge to the graph convolutional network through collaborative learning, and vice versa. Through this dynamic mutual learning process, both modules improve their accuracy. Compared to existing models, CoLogGNN achieves effective training using only normal samples, significantly reducing the cost of data annotation. Experimental results on five public datasets demonstrate that the proposed model exhibits superior detection performance, improving the F1score by approximately 5% over previous methods.

Key words: log anomaly detection, knowledge distillation, directed graph, collaborative learning, unsupervised learning

摘要： 日志异常检测在网络安全领域起着关键作用，但现有方法仍存在挑战.监督学习方法依赖大量标注数据，标注过程耗时且成本高.无监督学习方法虽然无需标注，但在复杂日志环境下难以有效提取关键特征，影响检测性能.为了解决这些问题，提出了一种知识蒸馏方法——协作学习，并在此基础上提出了一种基于协作学习的日志异常检测模型CoLogGNN.该模型首先将日志数据转换为有向图，以更全面地保留日志之间的结构信息.在训练初期CoLogGNN模型在正常样本上进行无监督学习，挖掘日志内在结构.在混合样本训练阶段，图注意力网络和图卷积模块相互协作，彼此指导.当图注意力网络在某些样本处理上更具优势时，它会通过协作学习向图卷积网络传递关键知识，反之亦然.通过这种动态的相互学习，2个模块的准确率得以共同提升.相较于其他现有模型，CoLogGNN模型仅依靠正常样本就能完成训练，大大降低了数据标注成本.经过在5个公开数据集的实验验证，该模型展现出显著的检测优势，相比以往方法F1值提高了约5%.

关键词: 日志异常检测, 知识蒸馏, 有向图, 协作学习, 无监督学习