Detecting Anomalous Behaviours Based on System Logs: A Dynamic Graph Perspective
Ming Wang, Yuman Wang, Tianqi Wu, Cen Chen, Kexiang Qian · 2023
System logs provide rich information about the current system’s state. To make use of system logs, various existing work extracts a causal graph from the log events, and then applies graph-based machine learning algorithms to detect the anomalous behaviors. One limitation of these work is that they treat the graph in a static way, neglecting the dynamic nature of anomalous behaviors. In this paper, we propose to detect anomalous behaviors based on system logs using dynamic graph modeling. Our method consists of several key steps, including negative sampling which helps to balance the dataset, edge encoding which encodes the spatial information for each behavior, and sequence modeling which further models the temporal information. Experimental evaluations on real datasets demonstrate the effectiveness of the proposed approach.