LogDualLearn: Dual-Expert Collaborative Learning for Unsupervised Log Anomaly Detection

Most existing log anomaly detection approaches either require large amounts of labeled data or exhibit limited effectiveness against complex anomalies that simultaneously involve structural and semantic deviations. This paper proposes LogDualLearn, a fully unsupervised framework that achieves high-precision anomaly detection through dual-expert collaborative learning. Log sequences are first transformed into directed heterogeneous graphs using Logs2Graphs to preserve both structural dependencies and rich node semantics. Exploiting the complementary strengths of Graph Convolutional Networks (excellent at capturing global structural irregularities) and Graph Attention Networks (superior at identifying local semantic anomalies), we design a three-stage collaborative learning strategy consisting of independent pre-specialization, explicit bidirectional knowledge transfer with dedicated distillation losses, and mutual examination optimization. This mechanism enables the structural expert to teach anomaly patterns related to edge bursts and connectivity to the semantic expert, while the semantic expert transfers evidence about unseen templates and error-level surges back to the structural expert. Experimental results on three datasets show that LogDualLearn achieves an average improvement of 3% in F1-score over the baseline methods.