MADDC: Multi-Scale Anomaly Detection, Diagnosis and Correction for Discrete Event Logs

Wang, Xiaolei; Yang, Lin; Li, Dongyang; Ma, Linru; He, Yongzhong; Xiao, Junchao; Liu, Jiyuan; Yang, Yuexiang

doi:10.1145/3564625.3567972

Cited by 7 publications

(1 citation statement)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Methods like LayerLog [42], CAT [44], and BPESequence [29] have emphasized the exploration of multi-level semantic correlations, spanning from individual words to sequences, intending to acquire more precise representations of behaviors. On the other hand, RADT [5] and MADDC [37] have focused on contextual information to enhance detection performance and robustness.…”

Section: Detection Based On Features and Sequencesmentioning

confidence: 99%

PhoGAD: Graph-based Anomaly Behavior Detection with Persistent Homology Optimization

Yuan,

Zhou,

Chen

et al. 2024

Proceedings of the 17th ACM International Conference on Web Search and Data Mining

View full text Add to dashboard Cite

A multitude of toxic online behaviors, ranging from network attacks to anonymous traffic and spam, have severely disrupted the smooth operation of networks. Due to the inherent sender-receiver nature of network behaviors, graph-based frameworks are commonly used for detecting anomalous behaviors. However, in real-world scenarios, the boundary between normal and anomalous behaviors tends to be ambiguous. The local heterophily of graphs interferes with the detection, and existing methods based on nodes or edges introduce unwanted noise into representation results, thereby impacting the effectiveness of detection. To address these issues, we propose PhoGAD, a graph-based anomaly detection framework. PhoGAD leverages persistent homology optimization to clarify behavioral boundaries. Building upon this, the weights of adjacent edges are designed to mitigate the effects of local heterophily. Subsequently, to tackle the noise problem, we conduct a formal analysis and propose a disentangled representation-based explicit embedding method, ultimately achieving anomaly behavior detection. Experiments on intrusion, traffic, and spam datasets verify that PhoGAD has surpassed the performance of state-of-the-art (SOTA) frameworks in detection efficacy. Notably, PhoGAD demonstrates robust detection even with diminished anomaly proportions, highlighting its applicability to real-world scenarios. The analysis of persistent homology demonstrates its effectiveness in capturing the topological structure formed by normal edge features. Additionally, ablation experiments

show abstract

Section: Detection Based On Features and Sequencesmentioning

confidence: 99%

PhoGAD: Graph-based Anomaly Behavior Detection with Persistent Homology Optimization

Yuan,

Zhou,

Chen

et al. 2024

Proceedings of the 17th ACM International Conference on Web Search and Data Mining

View full text Add to dashboard Cite

show abstract

Advances in deep learning intrusion detection over encrypted data with privacy preservation: a systematic review

Hendaoui,

Ferchichi,

Trabelsi

et al. 2024

Cluster Comput

View full text Add to dashboard Cite

Landscape and Taxonomy of Online Parser-Supported Log Anomaly Detection Methods

Lupton,

Washizaki,

Yoshioka

et al. 2024

IEEE Access

View full text Add to dashboard Cite

As production system estates become larger and more complex, ensuring stability through traditional monitoring approaches becomes more challenging. Rule-based monitoring is common in industrial settings, but it has limitations. These include the difficulty of crafting rules capable of detecting unforeseen issues and the burden of manually maintaining rule sets. A potential solution to effectively manage complex system states is log anomaly detection. Workflows for log anomaly detection utilize several fundamental components. These include preprocessors for data cleansing, parsers to extract structured information from raw log data, encoding algorithms to convert extracted data into usable model input features, anomaly detection methods to isolate anomalous signals, and feedback mechanisms to incrementally improve model performance. This study explores the current state of research into online parser-supported log anomaly detection methods, investigates recent research trends, compares the performances of parser and anomaly detection methods using common public datasets and metrics, and assesses their performance evolution over time. Additionally, it classifies available methods using a newly introduced taxonomy, highlights current research gaps, and recommends future research directions.INDEX TERMS Log parsing, log template extraction, online algorithms, anomaly detection.

show abstract

MADDC: Multi-Scale Anomaly Detection, Diagnosis and Correction for Discrete Event Logs

Cited by 7 publications

References 24 publications

PhoGAD: Graph-based Anomaly Behavior Detection with Persistent Homology Optimization

PhoGAD: Graph-based Anomaly Behavior Detection with Persistent Homology Optimization

Advances in deep learning intrusion detection over encrypted data with privacy preservation: a systematic review

Landscape and Taxonomy of Online Parser-Supported Log Anomaly Detection Methods

Contact Info

Product

Resources

About