Techniques for detecting atypical events in event logs

A computing device for processing event logs, comprising:

• a memory storing one or more parameters or instructions for executing an operating system and one or more processes;
• and
• at least one processor coupled to the memory, wherein the at least one processor is configured to:
• obtain one or more event logs generated by a process executing on the computing device;
• for each event of multiple events in the one or more event logs:
• generate a table of logged event instances for the event, wherein each logged event instance includes a value for a parameter, wherein the parameter is a feature for anomaly detection based on a numeric count of distinct values for the parameter being within a threshold numeric range;
• identify a logged event instance as an anomaly in the process by processing the table using a trained autoencoder, the identifying being based on the value for the parameter in the logged event instance;
• and
• output an indication of the anomaly in the process.

A non-transitory computer-readable medium, comprising code executable by one or more processors for processing event logs, the code comprising code for:

• obtaining one or more event logs generated by a process executing on one or more computing devices;
• for each event of multiple events in the one or more event logs:
• generating a table of logged event instances for the event, wherein each logged event instance includes a value for a parameter, wherein the parameter is a feature for anomaly detection based on a numeric count of distinct values for the parameter being within a threshold numeric range;
• identifying a logged event instance as an anomaly in the process by processing the table using an autoencoder, the identifying being based on the value for the parameter in the logged event instance;
• and
• outputting an indication of the anomaly in the process.