Anomaly Detection in POSTFIX mail log using Principal Component Analysis
Cao-Phi Tran, Duc-Khanh Tran · 2018
Anomalies in a dataset are the abnormal observations of the data, and they often represent the problems or defectives coming from some changes in the system operation. Detecting the anomalies in a data set is the first step from which further analysis can be done to locate the actual root cause in the data. In this paper, we propose a general method to pinpoint the anomalies from a set of Postfix mail log. This method utilizes the Elastic Stack to collect and process log data, then applies Principal Component Analysis to separate the abnormal data from the normal one. To demonstrate the feasibility of the solution, we test it against a collection of a million Postfix log messages. The result is promising under experimentation as it can detect an anomaly at the time a spam mail attack occurs.