System and method of artificial intelligence assisted cyber threat identification via webserver logs

A computer system, comprising:

• a processor in communication with a controller and configured to:
• generate, at the transformer model, one or more embedding vectors utilizing the one or more run-time logs at an embedding layer of the transformer model;
• generate, at the transformer model, one or more positional embeddings associated with the time stamps of each of the one or more run-time logs;
• generate, at the transformer model, the one or more embedding vectors added with one or more positional embeddings;
• in response to sending the one or more embedding vectors to a self-attention module of the transformer model, output one or more dimensional-embedding vectors;
• in response to sending the one or more dimensional-embedding vectors to a linear layer and SoftMax function of the transformer model, output a predicted next-log probability;
• output a trained transformer model in response to the predicted next-log probability exceeding a convergence threshold;
• receive, at the trained transformer model, one or more run-time logs indicating information associated with interaction between a unique device and a server;
• output a user-score associated with the unique device and one or more run-time logs in response to determining a negative log-likelihood of the one or more run-time logs in a next-log prediction probability distribution modeled by the trained transformer model;
• output a server-score utilizing at least normal-cluster centers associated with the trained transformer model and the one or more run-time logs;
• and
• in response to a sum of the user-score and server-score exceeding a threshold, output an indication of a cyber-threat associated with the one or more run-time logs.

A computer system, comprising:

• one or more processor in communication with one or more controllers configured to:
• receive one or more historical logs indicating information associated with interaction of a server;
• send the one or more historical logs to the transformer model;
• generate, at the transformer model, one or more embedding vectors utilizing the one or more historical logs at an embedding layer of the transformer model;
• generate, at the transformer model, one or more positional embeddings associated with the time stamps of each of the one or more historical logs;
• generate, at the transformer model, the one or more embedding vectors added with one or more positional embeddings;
• in response to sending the one or more embedding vectors to a self-attention module of the transformer model, output one or more dimensional-embedding vectors;
• in response to sending the one or more dimensional-embedding vectors to a linear layer and SoftMax function of the transformer model, output a predicted next-log probability;
• output a trained transformer model in response to the predicted next-log probability exceeding a convergence threshold;
• receive one or more run-time logs indicating information associated with interaction between a unique device and the server;
• output a user-score associated with the device and the one or more run-time logs in response to determining a negative log-likelihood of the one or more run-time logs in the next-log prediction probability distribution modeled by the trained transformer model;
• output a server-score utilizing at least normal-cluster centers associated with the trained transformer model and the one or more run-time logs;
• and
• in response to a sum of the user-score and server-score exceeding a threshold, output an indication of a cyber-threat associated with the one or more run-time logs.