GenGLAD: a Generated Graph Based Log Anomaly Detection Framework

EasyChair Preprint no. 9842

Abstract

Information systems record the current states and the access records in logs, so logs become the data basis for detecting anomalies of system security. To realize log anomaly detection, frameworks based on text, sequence, and graph are applied. However, the existing frameworks could not extract the complex associations in logs, which leads to low accuracy. To meet the requirements of the hyperautomation framework for log analysis, this paper proposes GenGLAD, a generated graph based log anomaly detection framework. The generated graph is used to express the log associations, and the node embedding of the generated graph is obtained based on random walk and word2vec. Finally, we use clustering to realize unsupervised anomaly detection. Experiments verify the detection effect of GenGLAD. Compared with the existing detection frameworks, GenGLAD achieves the highest accuracy and improves the comprehensive detection effect.

Keyphrases: graph learning, Hyperautomation, Log anomaly detection

@Booklet{EasyChair:9842,
  author = {Haolei Wang and Yong Chen and Chao Zhang and Jian Li and Chun Gan and Yinxian Zhang and Xiao Chen},
  title = {GenGLAD: a Generated Graph Based Log Anomaly Detection Framework},
  howpublished = {EasyChair Preprint no. 9842},

  year = {EasyChair, 2023}}