Method, system and computer programs for system log compression

Abstract

A method, system and computer program for system log compression are provided. The method comprises: obtaining at least one first batch of complete and untampered system log entries; representing the system log entries as a provenance graph, with nodes of the graph representing system entities and edges representing relationships between the system entities, wherein each node and edge of the graph is assigned a set of features; embedding the system entities and relationships within the provenance graph into a continuous multidimensional vector space using an embedding algorithm; identifying expected behavior deviations of the system log entries using the embedded continuous vector space; comparing the identified system log entries that deviate from an expected behavior with a given threshold; and labeling system log entries as anomalous if their deviation is different to or falls outside the given threshold, and compressing the system log entries by discarding those are not labeled as anomalous.

Dependencies are inferred from the claim text.