Source-linked AI summary
Recurrent Neural Network Attention Mechanisms for Interpretable System Log Anomaly Detection
Andy Brown, Aaron Tuor, Brian Hutchinson, Nicole Nichols
TL;DR
The paper addresses scarce labeled data and limited interpretability in system-log anomaly detection. It presents unsupervised RNN language models with attention, reporting predictable performance after single-day pretraining while exposing feature importance and feature relationships.
Problem
System logs can generate terabytes daily, while labeled data is often scarce and relationships across logging sources and system entities require modeling.
Method
The paper presents unsupervised RNN language models using attention to model normal log-event distributions with limited feature engineering and online bounded-resource training.
Results
State-of-the-art performance is maintained, and single-day pretraining yields low performance variance across most models.
Takeaways & Limitations
Attention provides information about feature importance and relational mappings between features for model introspection and analysis.
Takeaways & Limitations
The first day is excluded from evaluation because the model has not yet completed a training phase.
Abstract
from arXiv · showhide
Deep learning has recently demonstrated state-of-the art performance on key tasks related to the maintenance of computer systems, such as intrusion detection, denial of service attack detection, hardware and software system failures, and malware detection. In these contexts, model interpretability is vital for administrator and analyst to trust and act on the automated analysis of machine learning models. Deep learning methods have been criticized as black box oracles which allow limited insight into decision factors. In this work we seek to "bridge the gap" between the impressive performance of deep learning models and the need for interpretable model introspection. To this end we present recurrent neural network (RNN) language models augmented with attention for anomaly detection in system logs. Our methods are generally applicable to any computer system and logging source. By incorporating attention variants into our RNN language models we create opportunities for model introspection and analysis without sacrificing state-of-the art performance. We demonstrate model performance and illustrate model interpretability on an intrusion detection task using the Los Alamos National Laboratory (LANL) cyber security dataset, reporting upward of 0.99 area under the receiver operator characteristic curve despite being trained only on a single day's worth of data.
1 INTRODUCTION
System logs support critical security and maintenance tasks, but their scale, scarce labels, system specificity, and complex relationships make analysis difficult. The paper addresses these challenges with unsupervised RNN language models augmented by attention for anomaly detection and model introspection.
- System logs support intrusion, insider-threat, malware, hardware-failure, and traffic-pattern analysis across large computer systems.
- Terabytes of daily log data, scarce or unbalanced labels, and system-specific data complicate knowledge extraction.
- Relationships across logging sources and system entities can obscure actionable information.
- Interpretability matters because automated administrative decisions can have significant consequences for organizations and individuals.
- The paper presents unsupervised RNN language models that model normal log-event distributions to detect anomalies and discover complex relationships.The approach avoids dependence on labeled data, requires little to no feature engineering, applies to serializable logging sources, and trains online with bounded resources.
- The work evaluates several attention mechanisms for system-log anomaly detection and uses them to support model introspection.
2 RELATED WORK
Prior work applies LSTMs and attention to system-log analysis and complex sequence modeling, while interpretability research emphasizes understanding automated decisions. This paper builds on those directions for interpretable log anomaly detection.
- Earlier system-log studies used LSTMs for hardware and software failure prediction and denial-of-service attack detection.Those approaches generated feature sequences using clustering or customized parsing, whereas this paper works directly with raw text after tokenization.
- Attention augments LSTM sequence models by dynamically weighting information from different sequence positions to provide longer-term context.
- Interpretability is motivated by the need to understand model-generated predictions in ethical and high-consequence decision settings.
- Figure 1 contrasts word-token and character-token representations of log lines.
- The paper examines what factors its models attend to when predicting anomaly scores.
3 METHODS
The proposed framework uses language models over sequences of log-line tokens and extends them with five attention variations. Each model produces a log-line-level anomaly score.
- The framework applies five attention variations to unsupervised language models for system-log anomaly detection.
- Language models consume sequences of log-line tokens and output anomaly scores for individual log lines.
3.1 Preliminaries
The preliminaries represent each log line as a token sequence and model its sequence probability with a language model. Word and character tokenization provide alternative representations, while each line receives a negative-log-likelihood anomaly score.
- 3.1 Preliminaries: Each log line is represented as a sequence of T vocabulary tokens, and language modeling assigns probabilities to token sequences.
- 3.1 Preliminaries: The model evaluates sequence probability through conditional token probabilities over the preceding token sequence.
- 3.1 Preliminaries: Each user’s data consist of a series of affiliated log lines, and every language model outputs one anomaly score per line.The score is the negative log-likelihood, so less probable events receive higher anomaly scores.
- 3.1 Preliminaries: Word tokenization uses CSV fields, splits user fields at “@”, and replaces infrequent words with an out-of-vocabulary token.A field value must occur at least 40 times to enter the vocabulary.
- 3.1 Preliminaries: Character tokenization uses printable ASCII characters, retains delimiters for field-switching context, and ignores the time field.
- 3.1 Preliminaries: The tiered language model models user sequences of log lines with an upper-tier LSTM.
3.2 Cyber Anomaly Language Models
The cyber anomaly language models extend event-level LSTM predictions with bidirectional and tiered context, while using negative log-likelihood as the anomaly score.
- Event-level models: The Event Model applies a standard LSTM to token sequences from individual log-lines.Tokens are embedded before the LSTM produces hidden vectors.
- Event-level models: The Bidirectional Event Model incorporates hidden states from both forward- and backward-running LSTMs.This conditions predictions on preceding and following tokens for richer context.
- Tiered models: Tiered variants add an upper-tier LSTM that models a user’s sequence of log-lines alongside lower-tier event representations.The upper tier receives a summary of lower-tier hidden states, and both tiers are trained jointly.
- Notation: The framework assumes vectors are row vectors and omits conventional transposes by left-multiplying matrices with row vectors.This is the paper’s notation convention for the model equations.
- Anomaly scoring: All language models are optimized by minimizing negative log-likelihood from EM or BEM predictions.The same objective serves as the anomaly score, with less probable events receiving higher scores.
3.3 Attention
The paper augments LSTM language models with dot-product attention that selectively conditions predictions on earlier hidden states. Attention weights provide interpretability, while variants differ in how query vectors encode positional, semantic, or tiered information.
- Attention mechanism: Attention selectively conditions each prediction on relevant earlier hidden states through a weighted-sum attention vector.The prediction function uses the previous hidden state together with the attention vector.
- Interpretability: Attention weights expose which hidden states contribute to each prediction, aiding interpretation of the model’s decision process.
- Event Model attention: Each Event Model attention step uses prior hidden states as values, with keys computed from those states and a learned projection matrix.The current query determines the weighted sum over the value matrix.
- Query variants: Fixed attention uses one learned query across all positions, assuming positional importance is token-independent.
- Query variants: Syntax attention uses position-dependent queries whose importance does not depend on the preceding token values.
- Query variants: Semantic variants derive queries from hidden-state information, while tiered attention replaces lower-tier averaging with a weighted average.The tiered design includes a bidirectional lower-tier configuration and shared attention parameters across sequences.
3.4 Online Training
The online training procedure continually adapts the model while preserving a fixed daily evaluation scale. Training and evaluation can also run concurrently by storing synchronized parameter copies.
- Online training: The syncopated online algorithm adapts continuously to changing network activity distributions and supports high-throughput streaming deployment.
- Online training: At each day’s beginning, evaluation uses fixed current-model parameters to avoid anomaly-score scale changes caused by continuous training.
- Evaluation schedule: The first day is excluded from evaluation because the model has not yet undergone training.
- Concurrent execution: Concurrent training and evaluation require two parameter copies that synchronize daily when the evaluation copy is updated.This design incurs additional space complexity.
4 EXPERIMENTS
The experiments evaluate attention-equipped RNN language models for anomaly detection using LANL authentication logs, with training on day 7 and evaluation on day 8. Results show attention effects depend on tokenization and model architecture.
- Experimental Setup: The study evaluates models on LANL authentication logs containing user, computer, authentication, orientation, and success/failure fields.The dataset contains over one billion log lines collected across 58 days; red-team labels are used only for evaluation.
- Experimental Setup: The deployment simulation trains on day 7 and evaluates on day 8, which contains 261 red-team events among more than seven million user log lines.Day 7 contains one red-team event, while day 8 has the largest number of red events in the dataset.
- Metrics and Normalization: Performance is measured with AUC ROC, where 1 indicates perfect detection and 0.5 indicates random guessing.The anomaly score is based on the summed negative log probabilities of tokens in each log line, with user-level normalization applied for word tokenization.
- Results: Low variance across random initializations suggests predictable behavior despite training with only a single day of pretraining.The authors report low variance for most models and connect this observation to rapid deployment.
- Word Tokenization Models: Word-level BEM outperforms EM, while adding attention to EM raises performance to match BEM and attention variants achieve very similar AUC scores.Tiered word models show only slight upward trends in mean and maximum values with forward or bidirectional attention.
- Character Tokenization Models: Character-level Fixed and Syntax attention do not improve performance, whereas semantic attention improves performance but remains below BEM.Fixed attention on the character EM has a standard deviation 2-15 times that of other models.
5 ANALYSIS
The analysis uses attention summaries and case studies to inspect which log fields and hidden states influence predictions. Fixed, syntax, and semantic mechanisms reveal different attention patterns, while tiered models often concentrate attention on states already carrying user context.
- Analysis Approach: Attention analysis combines global summary statistics with case studies of individual attention weights and language-model predictions.The two approaches examine overall model behavior and particular model decisions.
- Analysis Approach: Heatmaps show attention weights over previous hidden states, with larger weights indicating greater relevance to the current prediction.The first input token is excluded because it has no previous hidden states available for attention.
- Fixed: Fixed attention emphasizes the source user, destination domain, and source PC when predicting the success/failure token.The fixed model uses a single query that does not change with the current context.
- Syntax: Syntax attention uses position-specific queries and heavily attends to the source user when predicting the source PC.This behavior is consistent with word-tokenized models having position-dependent syntax.
- Semantic: Semantic attention learns similar, reasonable maps on fixed-syntax data, emphasizing source user and source PC while also highlighting field-specific features.Semantic 1 emphasizes authentication type, whereas Semantic 2 emphasizes destination user and destination PC.
- Tiered Models: Tiered forward models concentrate attention on the second-to-last hidden state, while bidirectional tiered models attend to the first state that summarizes both directions.The authors suggest these shortcuts are unnecessary because the tiered architecture already propagates relevant user context.
5.2 Case Studies
Case studies use semantic attention to connect anomaly scores with incorrect predictions and the hidden states receiving the greatest weight. The examples expose both field-level vocabulary interference and strong reliance on delimiters.
- Case Study Design: The case studies compare two red-team events with one randomly sampled non-anomalous event using word- and character-level semantic attention.Predicted-versus-true token divergences are especially important because they contribute heavily to anomaly scores.
- Word Tokenization: In both word-level cases, source PC predictions are incorrect with low confidence, but the non-anomalous case correctly predicts destination PC given source PC with very high probability.The red-team event instead predicts a token associated with a different field for destination PC.
- Word Tokenization: The red-team word case attends heavily to a hidden state involving the destination-user domain while predicting source user, linking the misclassification to shared field vocabulary.The authors note that separate vocabularies could improve performance at the cost of minor feature engineering.
- Character Tokenization: In the character case, the comma immediately before source PC receives the largest weight when predicting destination PC characters.The second-largest weight belongs to the comma immediately before the destination PC field begins.
- Character Tokenization: A character prediction assigns nearly 100% confidence to K while the true character N has near 0% probability, substantially increasing the anomaly score.The example again shows heavy dependence on delimiter hidden states.
6 CONCLUSIONS
The paper proposes five attention mechanisms for RNN language models that retain state-of-the-art performance while exposing feature importance and relationships between features. The authors identify architectural insights and broader evaluation as future directions.
- Contributions: The paper proposes five attention mechanisms for system-log language models.The conclusion distinguishes fixed and syntactic variants for fixed structures from semantic variants for varying lengths and looser structures.
- Conclusions: Attention provides information about feature importance and relational mapping while maintaining state-of-the-art performance.The authors also suggest that attention patterns can reveal architectural insights for future model design.
- Future Work: Future work includes evaluating other tasks and domains, testing additional attention variants, and allowing lower-tier models to attend over upper-tier hidden states.Examples include hardware-failure detection and bidirectional models with attention.