Log-based Semi-supervised Anomaly Detection and Explanation Using Temporal Visual Representations and Llms
Year: 2026
Type: other
Abstract: Cloud infrastructure logs are the primary signal for detecting security incidentsin modern deployments. Automated analysis is complicated by high log volume, the absence of labelled attack examples, and the existence of collective anomalies — attacks that appear individually normal but are anomalous in their aggregate volume, timing, or co-occurrence. The dominant unsupervised approach models sequences of log events and is structurally blind to attacks that alter only how much or how slowly requests are made. This thesis investigates image-based log encoding as a complementary detection paradigm. Five representations of time-windowed log bins are designed — capturing endpoint access frequencies, token co-occurrence, and spectral content — and a video Transformer encoder trained exclusively on normal traffic serves as the normality model. Detection is evaluated on seven synthetic attack scenarios injected into real OpenStack Keystone access logs and benchmarked against a sequence-based baseline under two temporal configurations. A large-language-model (LLM) explanation layer produces natural-language reports for flagged bins. The results confirm near-perfect complementarity between the two paradigms. The sequential baseline achieves AUC above 0.988 and F1 between 0.471 and 0.727 on five attacks that alter log sequences but is effectively blind to API abuse and Slowloris. The image-based encoder covers exactly those blind spots: token frequency achieves recall up to 0.962 on API abuse where the baseline records below 0.04; co-occurrence reaches 0.610 recall on the timing-based attack where the baseline records zero. The LLM layer classifies attack types with perfect accuracy for four of seven types. These results establish image-based log encoding as a viable and replicable complement to sequential detectors for comprehensive log anomaly detection.
Source: Doria (University of Helsinki)
Author: Cirkovic, Masa
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7212330484