KDLog: a selective knowledge distillation approach for sequential log anomaly detection

Log anomaly detection is a critical task for ensuring the reliability of complex systems. However, existing methods often suffer from poor adaptability and substantial retraining overhead as log data evolve. This paper introduces a novel framework called KDLog, a knowledge-distillation-based approach that enables accurate and efficient log anomaly detection in dynamic environments. KDLog employs a two-stage selective-distillation mechanism, in which a lightweight student model is trained using the high-confidence outputs generated by a teacher model, effectively preventing negative knowledge transfer. Compared with state-of-the-art methods, KDLog improves overall accuracy by 4.5%, F1-score by 4.3%, and recall by 3.3% on average across real-world datasets (HDFS and BGL). Moreover, it reduces model update time by 60–78% and achieves a smaller model size, by up to 50%, compared with deep learning baselines such as DeepLog and LogAnomaly. Statistical significance tests confirm the robustness of these improvements. Unlike prior methods, KDLog also demonstrates strong resilience to unseen log patterns, with less than a 4% performance drop under simulated log-template drift. These gains make KDLog a scalable and practical solution for real-time anomaly detection, effectively bridging the gap between high-performance learning and operational efficiency in production environments.