AnomalyAdapters: Parameter-Efficient Multi-Anomaly Task Detection

Abstract

The emergence of technological innovations brings sophisticated threats. Cyberattacks are increasing day by day aligned with these innovations and entails rapid solutions for defense mechanisms. These attacks may hinder enterprise operations or more importantly, interrupt critical infrastructure systems, that are essential to safety, security, and well-being of a society. Anomaly detection, as a protection step, is significant for ensuring a system security. Logs, which are accepted sources universally, are utilized in system health monitoring and intrusion detection systems. Recent developments in Natural Language Processing (NLP) studies show that contextual information decreases false-positives yield in detecting anomalous behaviors. Transformers and their adaptations to various language understanding tasks exemplify the enhanced ability to extract this information. Deep network based anomaly detection solutions use generally feature-based transfer learning methods. This type of learning presents a new set of weights for each log type. It is unfeasible and a redundant way considering various log sources. Also, a vague representation of model decisions prevents learning from threat data and improving model capability. In this paper, we propose AnomalyAdapters (AAs) which is an extensible multi-anomaly task detection model. It uses pretrained transformers' variant to encode a log sequences and adapters to learn a log structure and anomaly types. Adapter-based approach collects contextual information, eliminates information loss in learning, and learns anomaly detection tasks from different log sources without overuse of parameters. Lastly, our work elucidates the decision making process of the proposed model on different log datasets to emphasize extraction of threat data via explainability experiments.

Reinforced Transformer Learning for VSI-DDoS Detection in Edge Clouds

“…Moura et al [20] discuss the employment of open-source programmable asset orchestration to defend against faults, congestion, or cyber-attacks in edge cloud systems. Ünal et al [21] propose a multi-anomaly detection model for cyber threat data. Pretrained transformers' variant is used to encode log sequences for learning the structure along with anomaly types.…”

Landscape and Taxonomy of Online Parser-Supported Log Anomaly Detection Methods

“…Traditional rule-based approaches have many challenges, including the difficulty of creating rules that can detect unforeseen error conditions and the effort required to manually maintain rule sets. Advances in deep learning and anomaly detection methodologies show potential for practical use against many forms of log detection targets, including failures [1], security/network intrusions [2] [3] [4], and performance degradation indicators [5] [6]. These methods have the potential to improve upon the weaknesses of rule-based approaches in that they don't require manual rule creation or maintenance.…”