Hybrid Machine Learning for Anomaly Detection in Imbalanced IT Logs: Comparative Analysis of Supervised and Unsupervised Approaches
Marko Milic · Journal of Computer Sciences and Informatics. · 2025
Background: The increasing complexity and heterogeneity of IT systems have made anomaly detection a critical yet challenging task. Traditional rule-based and statistical methods often fail to identify rare and nuanced anomalies. Artificial Intelligence (AI), particularly machine learning (ML), offers new possibilities for detecting irregular patterns using both supervised and unsupervised techniques. Objective: This study evaluates the performance of three ML models—Random Forest, Isolation Forest, and Multi-Layer Perceptron (MLP)—for anomaly detection in imbalanced IT log data. It also explores the impact of data imbalance and proposes directions for hybrid model development. Methods: A dataset comprising 3,000 log entries (with 5% labeled anomalies) from simulated IT systems was used. Supervised and unsupervised models were developed and evaluated using metrics including accuracy, precision, recall, F1-score, and AUROC. The study incorporated preprocessing, feature engineering, and class-imbalance mitigation techniques such as cost-sensitive learning. Results: Random Forest and MLP models achieved 92.5% accuracy but showed zero precision and recall for anomalies, highlighting their ineffectiveness in imbalanced settings. Isolation Forest yielded slightly better performance with 3.5% precision and 2.2% recall. The findings emphasize the limitations of standard supervised models for rare anomaly detection. Conclusion: Supervised models, though accurate on majority-class data, are inadequate for anomaly detection in imbalanced logs. Unsupervised or hybrid models offer improved potential. Future work should include synthetic oversampling, integration of deep learning models like Variational Autoencoders (VAEs) and Generative Adversarial Networks (GANs), and validation on real-world datasets.