Recurrent Neural Network Language Models for Open Vocabulary Event-Level Cyber Anomaly Detection

1 code implementation • 2 Dec 2017 • Aaron Tuor, Ryan Baerwolf, Nicolas Knowles, Brian Hutchinson, Nicole Nichols, Rob Jasper

By treating system logs as threads of interleaved "sentences" (event log lines) to train online unsupervised neural network language models, our approach provides an adaptive model of normal network behavior.

Anomaly Detection Feature Engineering