Dual-Graph Fusion with Mutual Knowledge Distillation for Log Anomaly Detection

Advanced persistent threats are complex, stealthy, and long-lasting attacks that can seriously compromise networked systems. System logs provide critical information for APT detection, and provenance graph analysis is commonly used for log anomaly detection. However, existing graph-based methods build provenance graphs from a single perspective, lacking adequate integration of structural and semantic information among entities. To address this issue, we propose a log anomaly detection method based on dual graph modeling and mutual knowledge distillation. The structural branch captures event interactions among entities, while the semantic branch captures associations implied by node text attributes. Relational graph convolution is applied for representation learning in both views. During training, a mutual knowledge distillation framework enables the two branches to serve as teachers and students for each other, facilitating bidirectional knowledge transfer. A reliability estimator based on noise-perturbation invariance assigns higher weights to samples with more trustworthy teacher outputs. Experiments on three public datasets demonstrate that the proposed method achieves statistically significant improvements in Recall on Wget and Cadets, and in Precision on StreamSpot, while maintaining F1-scores comparable to MAGIC across several datasets. Threshold-independent ROC-AUC evaluation further shows that the observed advantages on Wget and Cadets are also reflected in anomaly ranking performance rather than being solely attributable to threshold selection. Ablation experiments validate the contributions of dual-graph modeling, mutual distillation, and the reliability estimation mechanism.