Spatio-temporal decomposition, clustering and identification for alert detection in system logs
Adetokunbo Makanju, Nur Zincir-Heywood, Evangelos Milios, Markus Latzel · 2012
In this work, we propose an approach based on analyzing the spatio-temporal partitions of a system log, generated by supercomputers consisting of several nodes, for alert detection without employing semantic analysis. In this case, "Spatial" refers to the source of the log event and "Temporal" refers to the time the log event was reported. Our research shows that these spatio-temporal partitions can be clustered to separate normal activity from anomalous activity, with high accuracy. Therefore, our proposed method provides an effective alert detection mechanism.