The invention discloses a
data element full-life-cycle log
anomaly detection method based on knowledge
distillation, and relates to the technical field of
big data anomaly detection, and the method comprises the steps: training an initial teacher model on a
label-free log, fitting an over-threshold value through a
peak value over-threshold method and generalized Pareto distribution to remove extreme samples, and forming a purification training subset; on the basis, a robust teacher model is trained again, and a lightweight student model is obtained through
distillation. In the online detection stage, a
cascade strategy of rapid screening of a student model and fine determination of a teacher model is adopted; in order to enhance the robustness and discrimination ability of
anomaly detection, on the teacher side, the uncertainty of a teacher model, the teacher-student prediction distribution difference and the
mahalanobis distance of a representation space are jointly utilized to construct an anomaly
score, and the limitation of dependence on single statistics is avoided. According to the method, a two-stage log anomaly detection framework is adopted, and efficient log anomaly detection under an unsupervised condition is realized through combination of knowledge
distillation and an extreme value theory.