Anomaly detection in virtual machine logs against irrelevant attribute interference.
Virtual machine logs are generated in large quantities. Virtual machine logs may contain some abnormal logs that indicate security risks or system failures of the virtual machine platform. Therefore, using unsupervised anomaly detection methods to identify abnormal logs is a meaningful task. However...
Saved in:
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Public Library of Science (PLoS)
2025-01-01
|
| Series: | PLoS ONE |
| Online Access: | https://doi.org/10.1371/journal.pone.0315897 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1841533198937358336 |
|---|---|
| author | Hao Zhang Yun Zhou Huahu Xu Jiangang Shi Xinhua Lin Yiqin Gao |
| author_facet | Hao Zhang Yun Zhou Huahu Xu Jiangang Shi Xinhua Lin Yiqin Gao |
| author_sort | Hao Zhang |
| collection | DOAJ |
| description | Virtual machine logs are generated in large quantities. Virtual machine logs may contain some abnormal logs that indicate security risks or system failures of the virtual machine platform. Therefore, using unsupervised anomaly detection methods to identify abnormal logs is a meaningful task. However, collecting accurate anomaly logs in the real world is often challenging, and there is inherent noise in the log information. Parsing logs and anomaly alerts can be time-consuming, making it important to improve their effectiveness and accuracy. To address these challenges, this paper proposes a method called LADSVM(Long Short-Term Memory + Autoencoder-Decoder + SVM). Firstly, the log parsing algorithm is used to parse the logs. Then, the feature extraction algorithm, which combines Long Short-Term Memory and Autoencoder-Decoder, is applied to extract features. Autoencoder-Decoder reduces the dimensionality of the data by mapping the high-dimensional input to a low-dimensional latent space. This helps eliminate redundant information and noise, extract key features, and increase robustness. Finally, the Support Vector Machine is utilized to detect different feature vector signals. Experimental results demonstrate that compared to traditional methods, this approach is capable of learning better features without any prior knowledge, while also exhibiting superior noise robustness and performance. The LADSVM approach excels at detecting anomalies in virtual machine logs characterized by strong sequential patterns and noise. However, its performance may vary when applied to disordered log data. This highlights the necessity of carefully selecting detection methods that align with the specific characteristics of different log data types. |
| format | Article |
| id | doaj-art-da924c9389f5405c9f3801753044b4d4 |
| institution | Kabale University |
| issn | 1932-6203 |
| language | English |
| publishDate | 2025-01-01 |
| publisher | Public Library of Science (PLoS) |
| record_format | Article |
| series | PLoS ONE |
| spelling | doaj-art-da924c9389f5405c9f3801753044b4d42025-01-17T05:31:43ZengPublic Library of Science (PLoS)PLoS ONE1932-62032025-01-01201e031589710.1371/journal.pone.0315897Anomaly detection in virtual machine logs against irrelevant attribute interference.Hao ZhangYun ZhouHuahu XuJiangang ShiXinhua LinYiqin GaoVirtual machine logs are generated in large quantities. Virtual machine logs may contain some abnormal logs that indicate security risks or system failures of the virtual machine platform. Therefore, using unsupervised anomaly detection methods to identify abnormal logs is a meaningful task. However, collecting accurate anomaly logs in the real world is often challenging, and there is inherent noise in the log information. Parsing logs and anomaly alerts can be time-consuming, making it important to improve their effectiveness and accuracy. To address these challenges, this paper proposes a method called LADSVM(Long Short-Term Memory + Autoencoder-Decoder + SVM). Firstly, the log parsing algorithm is used to parse the logs. Then, the feature extraction algorithm, which combines Long Short-Term Memory and Autoencoder-Decoder, is applied to extract features. Autoencoder-Decoder reduces the dimensionality of the data by mapping the high-dimensional input to a low-dimensional latent space. This helps eliminate redundant information and noise, extract key features, and increase robustness. Finally, the Support Vector Machine is utilized to detect different feature vector signals. Experimental results demonstrate that compared to traditional methods, this approach is capable of learning better features without any prior knowledge, while also exhibiting superior noise robustness and performance. The LADSVM approach excels at detecting anomalies in virtual machine logs characterized by strong sequential patterns and noise. However, its performance may vary when applied to disordered log data. This highlights the necessity of carefully selecting detection methods that align with the specific characteristics of different log data types.https://doi.org/10.1371/journal.pone.0315897 |
| spellingShingle | Hao Zhang Yun Zhou Huahu Xu Jiangang Shi Xinhua Lin Yiqin Gao Anomaly detection in virtual machine logs against irrelevant attribute interference. PLoS ONE |
| title | Anomaly detection in virtual machine logs against irrelevant attribute interference. |
| title_full | Anomaly detection in virtual machine logs against irrelevant attribute interference. |
| title_fullStr | Anomaly detection in virtual machine logs against irrelevant attribute interference. |
| title_full_unstemmed | Anomaly detection in virtual machine logs against irrelevant attribute interference. |
| title_short | Anomaly detection in virtual machine logs against irrelevant attribute interference. |
| title_sort | anomaly detection in virtual machine logs against irrelevant attribute interference |
| url | https://doi.org/10.1371/journal.pone.0315897 |
| work_keys_str_mv | AT haozhang anomalydetectioninvirtualmachinelogsagainstirrelevantattributeinterference AT yunzhou anomalydetectioninvirtualmachinelogsagainstirrelevantattributeinterference AT huahuxu anomalydetectioninvirtualmachinelogsagainstirrelevantattributeinterference AT jiangangshi anomalydetectioninvirtualmachinelogsagainstirrelevantattributeinterference AT xinhualin anomalydetectioninvirtualmachinelogsagainstirrelevantattributeinterference AT yiqingao anomalydetectioninvirtualmachinelogsagainstirrelevantattributeinterference |