Anomaly detection in virtual machine logs against irrelevant attribute interference.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Virtual machine logs generate vast amounts of data, potentially containing anomalies indicative of security risks or system failures.
• Identifying these anomalies is crucial for maintaining system integrity, but real-world log data often suffers from noise and collection challenges.
• Existing methods may struggle with accuracy and efficiency due to log complexity and inherent noise.

Purpose of the Study:

• To propose and evaluate a robust unsupervised anomaly detection method for virtual machine logs.
• To enhance the accuracy and effectiveness of anomaly detection in the presence of noisy and complex log data.
• To address the challenges of log parsing and feature extraction for improved anomaly identification.

Main Methods:

• Log parsing to preprocess raw log data.
• A hybrid feature extraction technique combining Long Short-Term Memory (LSTM) and Autoencoder-Decoder for dimensionality reduction and noise elimination.
• Support Vector Machine (SVM) for classifying extracted features and detecting anomalies.

Main Results:

• The proposed LADSVM method demonstrates superior performance compared to traditional approaches in detecting anomalies within virtual machine logs.
• The approach effectively learns relevant features without prior knowledge, exhibiting enhanced robustness against noise.
• Experimental results confirm the method's capability in handling sequential patterns and noisy log data.

Conclusions:

• LADSVM offers a powerful and accurate solution for unsupervised anomaly detection in virtual machine logs, particularly those with sequential patterns and noise.
• The method's noise robustness and ability to learn features without prior knowledge represent significant advancements.
• Careful selection of detection methods based on log data characteristics remains essential for optimal performance.