Anomaly identification in log files

A system comprising:

• one or more processors;
• and
• one or more computer-readable storage media collectively storing program instructions which, when executed by the one or more processors, are configured to cause the one or more processors to perform a method comprising:
• mapping a plurality of log entries into a bag-of-words matrix;
• determining respective cosine similarities between consecutive log entries in the bag-of-words matrix;
• converting the respective cosine similarities to respective states;
• determining respective state transitions between the consecutive log entries;
• generating a stochastic matrix based on the respective state transitions;
• and
• identifying an anomalous log entry based on an anomalous state transition that has a probability below a probability threshold, wherein the probability is based on the stochastic matrix.

A computer program product comprising one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions comprising instructions configured to cause one or more processors to perform a method comprising:

• mapping a plurality of log entries into a bag-of-words matrix;
• determining respective cosine similarities between consecutive log entries in the bag-of-words matrix;
• converting the respective cosine similarities to respective states;
• determining respective state transitions between the consecutive log entries;
• generating a stochastic matrix based on the respective state transitions;
• and
• identifying an anomalous log entry based on an anomalous state transition that has a probability below a probability threshold, wherein the probability is based on the stochastic matrix.