A unified framework for detecting point and collective anomalies in operating system logs via collaborative...

Area of Science:

• Computer Science
• Cybersecurity
• Artificial Intelligence

Background:

• Log anomaly detection is vital for operating system security.
• Unimodal methods overlook log data's diverse modalities, while multimodal methods struggle with inter-modal interactions.

Purpose of the Study:

• To propose CoLog, a novel framework for collaborative log encoding using multiple data modalities.
• To address the limitations of existing methods in handling log data heterogeneity and interactions.

Main Methods:

• CoLog employs collaborative transformers and multi-head impressed attention to learn inter-modal log data interactions.
• A modality adaptation layer is integrated to manage data heterogeneity arising from these interactions.

Main Results:

• CoLog significantly outperforms existing state-of-the-art methods in log anomaly detection.
• Achieved mean precision of 99.63%, recall of 99.59%, and F1 score of 99.61% across seven benchmark datasets.
• Demonstrated effectiveness in detecting both point and collective anomalies.

Conclusions:

• CoLog offers a sophisticated and effective unified framework for advanced log anomaly detection.
• The framework enhances cybersecurity, system monitoring, and operational efficiency through nuanced pattern learning.