Analysis of system log data using machine learning
AssigneeTriad National Security, LLC
InventorsElisabeth Ann Moore, Nathan A. Debardeleben, Sean P. Blanchard
Life of this patent
Estimating the term…
Abstract
Systems and methods for detecting anomalies in machine-generated logs are described. Machine-generated logs are processed and analyzed using machine learning models to determine whether a log message is anomalous. The system may use machine learning models that are configured to process particular types of log messages. An explanation for why the system detected an anomaly in the log message is also generated based on processing of the log message.
Claims20
A computer-implemented method for detecting an anomalous message in a machine-generated log, the method comprising:
- receiving a plurality of log messages of the machine-generated log, the plurality of log messages including at least a first log message and a second log message;
- determining a first process tag associated with the first log message and a second process tag associated with the second log message;
- selecting, from a plurality of machine learning models, a first machine learning model corresponding to the first process tag;
- processing the first log message using the first machine learning model to determine model data;
- determining, using the model data, that the first log message is potentially anomalous;
- determining, using the model data, an explanation for determining that the first log message is potentially anomalous;
- and
- generating output data including the explanation and an indicator that the first log message is anomalous.
A computing system for detecting an anomalous message in a machine-generated log, the system comprising:
- at least one processor;
- and
- at least one memory comprising instructions that, when executed by the at least one processor, cause the computing system to:
- receive a plurality of log messages of the machine-generated log;
- process the plurality of log messages to determine a first process tag associated with a first log message of the plurality of log messages and a second process tag associated with a second log message;
- select, from a plurality of machine learning models, a first machine learning model corresponding to the first process tag;
- process the first log message using the first machine learning model to determine model data;
- determine, using the model data, that the first log message is potentially anomalous;
- determine, using the model data, an explanation for determining that the first log message is potentially anomalous;
- and
- generate output data including the explanation and an indicator that the first log message is anomalous.
At least one non-transitory, computer-readable medium may be encoded with instructions which, when executed by at least one processor included in a system, cause the system to:
- receive a plurality of log messages of a machine-generated log;
- process the plurality of log messages to determine a first process tag associated with a first log message of the plurality of log messages and a second process tag associated with a second log message;
- select, from a plurality of machine learning models, a first machine learning model corresponding to the first process tag;
- process the first log message using the first machine learning model to determine model data;
- determine, using the model data, that the first log message is potentially anomalous;
- determine, using the model data, an explanation for determining that the first log message is potentially anomalous;
- and
- generate output data including the explanation and an indicator that the first log message is anomalous.
Dependencies are inferred from the claim text.