Towards an Approach for Representing Log Event in Anomaly Detection

With the development of information technology, ensuring the security of IT system is of paramount importance. Currently, AI is being applied to the detection of abnormalities in attacks on IT system. Current anomaly detection models focus on detection based on the appearance of device syslog. However, these models face the obstacle of too large windows size, which affects the performance of the model and the model size is still quite large. This study proposes a graph-based model to overcome the disadvantage of current models. The results show that the proposed graph representation can provide better performance than current models. Experiments with four different datasets all showed F1 reaching a level of 0.992 or higher.