Netinfo Security ›› 2023, Vol. 23 ›› Issue (10): 16-20.doi: 10.3969/j.issn.1671-1122.2023.10.003

Previous Articles     Next Articles

A Log Anomaly Detection Method with Variables

ZHANG Yuchen, LI Lianghui, MA Chenyang, ZHOU Hongwei()   

  1. Department of Cryptographic Engineering, Information Engineering University of PLA, Zhengzhou 450001, China
  • Received:2023-06-04 Online:2023-10-10 Published:2023-10-11

Abstract:

In order to fully tap the potential of variables in logs and optimize the effectiveness of log anomaly detection, this paper proposed a novel log anomaly detection method SiEv with the variables. Firstly, this method identified the subject variable in the log, and divided the log into different fragments based on the subject variable. Then, SiEv took these fragments as input for LSTM to avoid mutual interference between log sequence features of different subjects. Finally, according to different log fragments, SiEv was able to be divided into multiple categories to detect logs with the view of different perspectives. To verify the effectiveness of the method, SiEv was tested with the log dataset provided by the Loghub. The experimental results indicate that SiEv is able to detect anomalies in various types of logs, identify the activity behavior patterns and trends of the same subject.

Key words: log, anomaly detection, LSTM, variables

CLC Number: