{"id":"https://openalex.org/W7225339397","doi":"https://doi.org/10.3390/sym18111855","title":"Dual-Graph Fusion with Mutual Knowledge Distillation for Log Anomaly Detection","display_name":"Dual-Graph Fusion with Mutual Knowledge Distillation for Log Anomaly Detection","publication_year":2026,"publication_date":"2026-11-05","ids":{"openalex":"https://openalex.org/W7225339397","doi":"https://doi.org/10.3390/sym18111855"},"language":"en","primary_location":{"id":"doi:10.3390/sym18111855","doi":"https://doi.org/10.3390/sym18111855","is_oa":true,"landing_page_url":"https://doi.org/10.3390/sym18111855","pdf_url":null,"source":{"id":"https://openalex.org/S190787756","display_name":"Symmetry","issn_l":"2073-8994","issn":["2073-8994"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","cwts-core","norway-1","poland-70","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Symmetry","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.3390/sym18111855","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5124223599","display_name":"Dacheng Shan","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I17442442","display_name":"State Grid Corporation of China (China)","ror":"https://ror.org/05twwhs70","country_code":"CN","type":"company","lineage":["https://openalex.org/I17442442"]},{"id":"https://openalex.org/I4210118629","display_name":"NARI Group (China)","ror":"https://ror.org/02egn3136","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210118629"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Dacheng Shan","raw_affiliation_strings":["Nanjing NARI Information and Communication Technology Co., Ltd., Nanjing 211106, China","Nari Group Corporation (State Grid Electric Power Research Institute), Nanjing 211106, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Nanjing NARI Information and Communication Technology Co., Ltd., Nanjing 211106, China","institution_ids":["https://openalex.org/I4210118629"]},{"raw_affiliation_string":"Nari Group Corporation (State Grid Electric Power Research Institute), Nanjing 211106, China","institution_ids":["https://openalex.org/I17442442"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100891548","display_name":"Shishun Zhu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I17442442","display_name":"State Grid Corporation of China (China)","ror":"https://ror.org/05twwhs70","country_code":"CN","type":"company","lineage":["https://openalex.org/I17442442"]},{"id":"https://openalex.org/I4210118629","display_name":"NARI Group (China)","ror":"https://ror.org/02egn3136","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210118629"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shishun Zhu","raw_affiliation_strings":["Nanjing NARI Information and Communication Technology Co., Ltd., Nanjing 211106, China","Nari Group Corporation (State Grid Electric Power Research Institute), Nanjing 211106, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Nanjing NARI Information and Communication Technology Co., Ltd., Nanjing 211106, China","institution_ids":["https://openalex.org/I4210118629"]},{"raw_affiliation_string":"Nari Group Corporation (State Grid Electric Power Research Institute), Nanjing 211106, China","institution_ids":["https://openalex.org/I17442442"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5140241933","display_name":"Changchun Cheng","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I17442442","display_name":"State Grid Corporation of China (China)","ror":"https://ror.org/05twwhs70","country_code":"CN","type":"company","lineage":["https://openalex.org/I17442442"]},{"id":"https://openalex.org/I4210118629","display_name":"NARI Group (China)","ror":"https://ror.org/02egn3136","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210118629"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Changchun Cheng","raw_affiliation_strings":["Nanjing NARI Information and Communication Technology Co., Ltd., Nanjing 211106, China","Nari Group Corporation (State Grid Electric Power Research Institute), Nanjing 211106, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Nanjing NARI Information and Communication Technology Co., Ltd., Nanjing 211106, China","institution_ids":["https://openalex.org/I4210118629"]},{"raw_affiliation_string":"Nari Group Corporation (State Grid Electric Power Research Institute), Nanjing 211106, China","institution_ids":["https://openalex.org/I17442442"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5160823121","display_name":"Wei Liu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I17442442","display_name":"State Grid Corporation of China (China)","ror":"https://ror.org/05twwhs70","country_code":"CN","type":"company","lineage":["https://openalex.org/I17442442"]},{"id":"https://openalex.org/I4210118629","display_name":"NARI Group (China)","ror":"https://ror.org/02egn3136","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210118629"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wei Liu","raw_affiliation_strings":["Nanjing NARI Information and Communication Technology Co., Ltd., Nanjing 211106, China","Nari Group Corporation (State Grid Electric Power Research Institute), Nanjing 211106, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Nanjing NARI Information and Communication Technology Co., Ltd., Nanjing 211106, China","institution_ids":["https://openalex.org/I4210118629"]},{"raw_affiliation_string":"Nari Group Corporation (State Grid Electric Power Research Institute), Nanjing 211106, China","institution_ids":["https://openalex.org/I17442442"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5160933273","display_name":"Yuxuan Yang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I17442442","display_name":"State Grid Corporation of China (China)","ror":"https://ror.org/05twwhs70","country_code":"CN","type":"company","lineage":["https://openalex.org/I17442442"]},{"id":"https://openalex.org/I4210118629","display_name":"NARI Group (China)","ror":"https://ror.org/02egn3136","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210118629"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuxuan Yang","raw_affiliation_strings":["Nanjing NARI Information and Communication Technology Co., Ltd., Nanjing 211106, China","Nari Group Corporation (State Grid Electric Power Research Institute), Nanjing 211106, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Nanjing NARI Information and Communication Technology Co., Ltd., Nanjing 211106, China","institution_ids":["https://openalex.org/I4210118629"]},{"raw_affiliation_string":"Nari Group Corporation (State Grid Electric Power Research Institute), Nanjing 211106, China","institution_ids":["https://openalex.org/I17442442"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5160937587","display_name":"Yan Li","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4405272831","display_name":"State Grid Henan Electric Power Company (China)","ror":"https://ror.org/04sf3y026","country_code":"CN","type":"company","lineage":["https://openalex.org/I4405272831"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yan Li","raw_affiliation_strings":["State Grid Henan Electric Power Company, Zhengzhou 450018, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"State Grid Henan Electric Power Company, Zhengzhou 450018, China","institution_ids":["https://openalex.org/I4405272831"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5160937684","display_name":"Cen Chen","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cen Chen","raw_affiliation_strings":["State Grid Henan Electric Power Research Institute, Zhengzhou 450052, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"State Grid Henan Electric Power Research Institute, Zhengzhou 450052, China","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5124223599"],"corresponding_institution_ids":["https://openalex.org/I17442442","https://openalex.org/I4210118629"],"apc_list":{"value":2400,"currency":"CHF","value_usd":2896},"apc_paid":{"value":2400,"currency":"CHF","value_usd":2896},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"18","issue":"11","first_page":"1855","last_page":"1855"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.6371999979019165,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.6371999979019165,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.3009999990463257,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.01549999974668026,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/log-based-anomaly-detection","display_name":"log anomaly detection","score":0.9980000257492065},{"id":"https://openalex.org/keywords/advanced-persistent-threats","display_name":"advanced persistent threats","score":0.9610000252723694},{"id":"https://openalex.org/keywords/provenance-graphs","display_name":"provenance graphs","score":0.6869999766349792},{"id":"https://openalex.org/keywords/reliability-estimation","display_name":"reliability estimation","score":0.6169999837875366},{"id":"https://openalex.org/keywords/network-security","display_name":"network security","score":0.531000018119812}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7192000150680542},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5253000259399414},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.46639999747276306},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.46470001339912415},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.45170000195503235},{"id":"https://openalex.org/C185429906","wikidata":"https://www.wikidata.org/wiki/Q1130160","display_name":"Estimator","level":2,"score":0.40450000762939453},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.4027999937534332},{"id":"https://openalex.org/C152139883","wikidata":"https://www.wikidata.org/wiki/Q252973","display_name":"Mutual information","level":2,"score":0.3797999918460846},{"id":"https://openalex.org/C81669768","wikidata":"https://www.wikidata.org/wiki/Q2359161","display_name":"Precision and recall","level":2,"score":0.3587000072002411},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3488999903202057},{"id":"https://openalex.org/C206588197","wikidata":"https://www.wikidata.org/wiki/Q846574","display_name":"Reuse","level":2,"score":0.3190999925136566},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.30480000376701355},{"id":"https://openalex.org/C72634772","wikidata":"https://www.wikidata.org/wiki/Q386824","display_name":"Data integration","level":2,"score":0.2980000078678131},{"id":"https://openalex.org/C33954974","wikidata":"https://www.wikidata.org/wiki/Q486494","display_name":"Sensor fusion","level":2,"score":0.2881999909877777},{"id":"https://openalex.org/C189430467","wikidata":"https://www.wikidata.org/wiki/Q7293293","display_name":"Ranking (information retrieval)","level":2,"score":0.2815999984741211},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.28049999475479126},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.27480000257492065},{"id":"https://openalex.org/C130318100","wikidata":"https://www.wikidata.org/wiki/Q2268914","display_name":"Semantic similarity","level":2,"score":0.26809999346733093},{"id":"https://openalex.org/C103278499","wikidata":"https://www.wikidata.org/wiki/Q254465","display_name":"Similarity (geometry)","level":3,"score":0.26429998874664307},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.2639999985694885},{"id":"https://openalex.org/C153701036","wikidata":"https://www.wikidata.org/wiki/Q659974","display_name":"Trustworthiness","level":2,"score":0.26269999146461487},{"id":"https://openalex.org/C152948882","wikidata":"https://www.wikidata.org/wiki/Q4060686","display_name":"Belief propagation","level":3,"score":0.2515999972820282}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.3390/sym18111855","doi":"https://doi.org/10.3390/sym18111855","is_oa":true,"landing_page_url":"https://doi.org/10.3390/sym18111855","pdf_url":null,"source":{"id":"https://openalex.org/S190787756","display_name":"Symmetry","issn_l":"2073-8994","issn":["2073-8994"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","cwts-core","norway-1","poland-70","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Symmetry","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.3390/sym18111855","doi":"https://doi.org/10.3390/sym18111855","is_oa":true,"landing_page_url":"https://doi.org/10.3390/sym18111855","pdf_url":null,"source":{"id":"https://openalex.org/S190787756","display_name":"Symmetry","issn_l":"2073-8994","issn":["2073-8994"],"is_oa":true,"is_in_doaj":false,"is_core":true,"listed_in":["anvur-scientific","cwts-core","norway-1","poland-70","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Symmetry","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":35,"referenced_works":["https://openalex.org/W2116341502","https://openalex.org/W2144499799","https://openalex.org/W2284900416","https://openalex.org/W2401686019","https://openalex.org/W2513712568","https://openalex.org/W2604314403","https://openalex.org/W2739879705","https://openalex.org/W2767094836","https://openalex.org/W2790557990","https://openalex.org/W2885195348","https://openalex.org/W2910711617","https://openalex.org/W2947745012","https://openalex.org/W2962703433","https://openalex.org/W2965198005","https://openalex.org/W2965838158","https://openalex.org/W2978956219","https://openalex.org/W2996913633","https://openalex.org/W2998038410","https://openalex.org/W3006711782","https://openalex.org/W3016038045","https://openalex.org/W3030901202","https://openalex.org/W3035321581","https://openalex.org/W3037424089","https://openalex.org/W3199174176","https://openalex.org/W3205214822","https://openalex.org/W3212868562","https://openalex.org/W3212906336","https://openalex.org/W3216510157","https://openalex.org/W4285603440","https://openalex.org/W4376480418","https://openalex.org/W4396506525","https://openalex.org/W4398252541","https://openalex.org/W4399557430","https://openalex.org/W4402673967","https://openalex.org/W4405236144"],"related_works":["https://openalex.org/W7215236612","https://openalex.org/W4388486015","https://openalex.org/W3161236358","https://openalex.org/W7223373627","https://openalex.org/W4389739997","https://openalex.org/W4386176731","https://openalex.org/W4391558097","https://openalex.org/W4401072124","https://openalex.org/W4393079429","https://openalex.org/W7208760916"],"abstract_inverted_index":{"Advanced":[0],"persistent":[1],"threats":[2],"are":[3,193],"complex,":[4],"stealthy,":[5],"and":[6,23,50,71,120,164,166,191,218],"long-lasting":[7],"attacks":[8],"that":[9,152,185],"can":[10],"seriously":[11],"compromise":[12],"networked":[13],"systems.":[14],"System":[15],"logs":[16],"provide":[17],"critical":[18],"information":[19,52],"for":[20,30,99,122],"APT":[21],"detection,":[22],"provenance":[24,39],"graph":[25,69,95],"analysis":[26],"is":[27,97],"commonly":[28],"used":[29],"log":[31,62],"anomaly":[32,63,197],"detection.":[33],"However,":[34],"existing":[35],"graph-based":[36],"methods":[37],"build":[38],"graphs":[40],"from":[41],"a":[42,61,107],"single":[43],"perspective,":[44],"lacking":[45],"adequate":[46],"integration":[47],"of":[48,213],"structural":[49,76],"semantic":[51,85],"among":[53,81],"entities.":[54],"To":[55],"address":[56],"this":[57],"issue,":[58],"we":[59],"propose":[60],"detection":[64],"method":[65,155],"based":[66,132],"on":[67,133,147,162,169,189],"dual":[68],"modeling":[70],"mutual":[72,108,216],"knowledge":[73,109,127],"distillation.":[74],"The":[75],"branch":[77,86],"captures":[78,87],"event":[79],"interactions":[80],"entities,":[82],"while":[83,171],"the":[84,113,153,186,211,219],"associations":[88],"implied":[89],"by":[90],"node":[91],"text":[92],"attributes.":[93],"Relational":[94],"convolution":[96],"applied":[98],"representation":[100],"learning":[101],"in":[102,160,167,196],"both":[103],"views.":[104],"During":[105],"training,":[106],"distillation":[110],"framework":[111],"enables":[112],"two":[114],"branches":[115],"to":[116,139,175,205],"serve":[117],"as":[118],"teachers":[119],"students":[121],"each":[123],"other,":[124],"facilitating":[125],"bidirectional":[126],"transfer.":[128],"A":[129],"reliability":[130,220],"estimator":[131],"noise-perturbation":[134],"invariance":[135],"assigns":[136],"higher":[137],"weights":[138],"samples":[140],"with":[141],"more":[142],"trustworthy":[143],"teacher":[144],"outputs.":[145],"Experiments":[146],"three":[148],"public":[149],"datasets":[150],"demonstrate":[151],"proposed":[154],"achieves":[156],"statistically":[157],"significant":[158],"improvements":[159],"Recall":[161],"Wget":[163,190],"Cadets,":[165],"Precision":[168],"StreamSpot,":[170],"maintaining":[172],"F1-scores":[173],"comparable":[174],"MAGIC":[176],"across":[177],"several":[178],"datasets.":[179],"Threshold-independent":[180],"ROC-AUC":[181],"evaluation":[182],"further":[183],"shows":[184],"observed":[187],"advantages":[188],"Cadets":[192],"also":[194],"reflected":[195],"ranking":[198],"performance":[199],"rather":[200],"than":[201],"being":[202],"solely":[203],"attributable":[204],"threshold":[206],"selection.":[207],"Ablation":[208],"experiments":[209],"validate":[210],"contributions":[212],"dual-graph":[214],"modeling,":[215],"distillation,":[217],"estimation":[221],"mechanism.":[222]},"counts_by_year":[],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-11-06T00:00:00"}