SKDLog: Self-Knowledge Distillation-based CNN for Abnormal Log Detection

System logs are critical to system health diagnosis, especially for big data distributed systems. To detect anomalies in logs, log analysis has become a popular and practical approach. However, with the increasing complexity of system logs in real-world systems, more noisy data are generated. The noise disturbs the regular detection procedure and decreases the detection quality. Hence, it is more difficult to improve detection performance under such uncertain circumstance. To tackle this challenge, we propose SKDLog, a novel and effective log anomaly detection method equipped with self-knowledge distillation. This approach leverages the knowledge from soft labels and refined feature maps through knowledge distillation. Moreover, it helps the detection model better acquire latent information. To better exploit feature maps, an auxiliary self-teacher branch is incorporated into the framework. After the integration, the model achieves performance gain in log anomaly detection. To demonstrate the effectiveness, we compare SKDLog with the state-of-the-art log-based anomaly detection approaches on HDFS and Hadoop Application datasets. Our model outperforms other approaches on both recall and F1-score. Furthermore, we challenge problem solving by performing experiments on an industry dataset and an unstable dataset. The experimental results show that SKDLog more accurately detects abnormal logs from noisy data with high recall and F1-score.