Valid Probabilistic Anomaly Detection Models for System Logs

<div>Scatterplot of the distribution of predicted probabilities <svg height="10.2124pt" id="M107" style="vertical-align:-3.42943pt" version="1.1" viewbox="-0.0498162 -6.78297 7.83752 10.2124" width="7.83752pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M570 304C570 398 525 448 414 448C385 448 343 445 312 434L329 511L321 518C297 504 262 482 244 460L233 411C195 397 159 381 128 358L135 332C160 347 189 360 224 373L111 -147C97 -210 84 -218 17 -231L13 -257L254 -247L259 -218L233 -216C183 -212 177 -202 189 -142L218 -1C238 -10 266 -12 283 -12C351 3 429 48 483 105C543 168 570 242 570 304ZM482 289C482 161 380 33 304 33C278 33 248 51 233 69L303 396C326 400 352 403 369 403C428 403 482 380 482 289Z"></path></g></svg> and test labels (0 and 1) in the LR model under different threshold values. (a) The distribution of probability <svg height="10.2124pt" id="M108" style="vertical-align:-3.42943pt" version="1.1" viewbox="-0.0498162 -6.78297 7.83752 10.2124" width="7.83752pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M570 304C570 398 525 448 414 448C385 448 343 445 312 434L329 511L321 518C297 504 262 482 244 460L233 411C195 397 159 381 128 358L135 332C160 347 189 360 224 373L111 -147C97 -210 84 -218 17 -231L13 -257L254 -247L259 -218L233 -216C183 -212 177 -202 189 -142L218 -1C238 -10 266 -12 283 -12C351 3 429 48 483 105C543 168 570 242 570 304ZM482 289C482 161 380 33 304 33C278 33 248 51 233 69L303 396C326 400 352 403 369 403C428 403 482 380 482 289Z"></path></g></svg> and label when <span class="nowrap"><svg height="9.51429pt" id="M109" style="vertical-align:-0.2063894pt" version="1.1" viewbox="-0.0498162 -9.3079 86.4387 9.51429" width="86.4387pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M298 36L289 62C276 55 253 45 228 45C202 45 169 60 169 141V397H276C289 405 292 426 282 437H169V574L155 576L90 509V437H45L17 408L21 397H90V107C90 28 125 -12 188 -12C198 -12 213 -8 230 1L298 36Z"></path></g><g transform="matrix(.013,0,0,-0.013,4.043,0)"><path d="M513 0V26C455 31 447 37 447 103V278C447 398 390 449 309 449C255 449 202 412 166 376V712C127 700 67 684 19 677V653C85 647 87 643 87 580V103C87 37 79 31 19 26L18 0H231V26C171 32 166 39 166 103V341C194 373 232 392 270 392C337 392 368 351 368 269V103C368 38 360 32 302 26V0H513Z"></path></g><g transform="matrix(.013,0,0,-0.013,10.985,0)"><path d="M181 342V451C133 431 89 419 40 411V388C98 381 102 377 102 311V104C102 38 95 32 33 26V0H263V26C186 32 181 38 181 104V287C203 343 235 372 261 372C277 372 289 366 304 352C310 346 318 345 330 350C349 359 362 379 362 399C362 422 338 449 304 449C256 449 213 393 183 342H181Z"></path></g><g transform="matrix(.013,0,0,-0.013,15.639,0)"><path d="M380 106C343 72 306 56 265 56C195 56 116 112 115 248C235 252 361 262 377 265C396 269 400 277 400 297C400 374 333 449 250 449H249C198 449 144 421 103 376S37 269 37 201C37 88 109 -12 232 -12C263 -12 332 6 395 84L380 106ZM225 412C281 412 315 364 314 312C314 297 308 292 290 292C232 290 176 289 120 289C135 370 180 412 225 412Z"></path></g><g transform="matrix(.013,0,0,-0.013,21.164,0)"><path d="M319 325C317 349 306 409 297 431C277 440 250 449 209 449C117 449 57 389 57 319C57 243 122 209 182 182C232 159 261 135 261 91C261 48 227 21 190 21C130 21 85 79 68 145L41 140C41 104 51 36 58 22C75 7 121 -12 172 -12C252 -12 337 35 337 126C337 195 286 231 210 262C166 281 126 304 126 348C126 388 152 417 191 417C240 417 274 378 294 318L319 325Z"></path></g><g transform="matrix(.013,0,0,-0.013,25.882,0)"><path d="M513 0V26C455 31 447 37 447 103V278C447 398 390 449 309 449C255 449 202 412 166 376V712C127 700 67 684 19 677V653C85 647 87 643 87 580V103C87 37 79 31 19 26L18 0H231V26C171 32 166 39 166 103V341C194 373 232 392 270 392C337 392 368 351 368 269V103C368 38 360 32 302 26V0H513Z"></path></g><g transform="matrix(.013,0,0,-0.013,32.772,0)"><path d="M257 449C165 449 37 374 37 209C37 98 119 -12 256 -12C355 -12 473 65 473 226C473 349 381 449 257 449ZM244 416C333 416 380 320 380 204C380 67 329 21 267 21C184 21 130 115 130 241C130 354 184 416 244 416Z"></path></g><g transform="matrix(.013,0,0,-0.013,39.311,0)"><path d="M238 0V26C174 32 166 38 166 104V712C132 700 70 683 18 677V653C81 647 87 645 87 577V104C87 38 78 32 15 26V0H238Z"></path></g><g transform="matrix(.013,0,0,-0.013,42.6,0)"><path d="M517 51L485 54C448 58 441 63 441 115V712C404 700 337 684 285 678V653C357 648 362 645 362 580V437C339 446 309 449 295 449C159 449 38 340 38 201C38 61 143 -12 223 -12C234 -12 261 -6 301 17L362 53V-12C420 9 495 22 517 26V51ZM362 85C338 67 301 51 266 51C201 51 128 109 128 228C128 373 212 411 259 411C296 411 338 395 362 360V85Z"></path></g><g transform="matrix(.013,0,0,-0.013,53.282,0)"><path d="M535 323V373H52V323H535ZM535 138V188H52V138H535Z"></path></g><g transform="matrix(.013,0,0,-0.013,64.545,0)"><path d="M241 635C89 635 35 457 35 312C35 153 89 -12 240 -12C390 -12 443 166 443 312C443 466 390 635 241 635ZM238 602C329 602 354 454 354 312C354 172 330 22 240 22C152 22 124 173 124 313S148 602 238 602Z"></path></g><g transform="matrix(.013,0,0,-0.013,70.785,0)"><path d="M113 -12C146 -12 170 11 170 46C170 78 146 103 114 103S58 78 58 46C58 11 82 -12 113 -12Z"></path></g><g transform="matrix(.013,0,0,-0.013,73.749,0)"><path d="M447 623H65C61 580 56 530 47 475H76C100 541 106 550 172 550H388C308 376 196 170 91 -1L98 -12L172 -2C268 204 360 408 455 611L447 623Z"></path></g><g transform="matrix(.013,0,0,-0.013,79.991,0)"><path d="M412 140C382 77 369 73 315 73H129L270 222C362 320 402 379 402 466C402 571 322 635 234 635C177 635 130 609 99 576L42 495L64 475C90 514 133 568 201 568C274 568 318 519 318 435C318 349 255 267 193 193C144 135 87 78 32 23V0H405C417 45 427 89 440 131L412 140Z"></path></g></svg>.</span> (b) The distribution of probability <svg height="10.2124pt" id="M110" style="vertical-align:-3.42943pt" version="1.1" viewbox="-0.0498162 -6.78297 7.83752 10.2124" width="7.83752pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M570 304C570 398 525 448 414 448C385 448 343 445 312 434L329 511L321 518C297 504 262 482 244 460L233 411C195 397 159 381 128 358L135 332C160 347 189 360 224 373L111 -147C97 -210 84 -218 17 -231L13 -257L254 -247L259 -218L233 -216C183 -212 177 -202 189 -142L218 -1C238 -10 266 -12 283 -12C351 3 429 48 483 105C543 168 570 242 570 304ZM482 289C482 161 380 33 304 33C278 33 248 51 233 69L303 396C326 400 352 403 369 403C428 403 482 380 482 289Z"></path></g></svg> and label when <span class="nowrap"><svg height="9.51429pt" id="M111" style="vertical-align:-0.2063894pt" version="1.1" viewbox="-0.0498162 -9.3079 80.1753 9.51429" width="80.1753pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M298 36L289 62C276 55 253 45 228 45C202 45 169 60 169 141V397H276C289 405 292 426 282 437H169V574L155 576L90 509V437H45L17 408L21 397H90V107C90 28 125 -12 188 -12C198 -12 213 -8 230 1L298 36Z"></path></g><g transform="matrix(.013,0,0,-0.013,4.043,0)"><path d="M513 0V26C455 31 447 37 447 103V278C447 398 390 449 309 449C255 449 202 412 166 376V712C127 700 67 684 19 677V653C85 647 87 643 87 580V103C87 37 79 31 19 26L18 0H231V26C171 32 166 39 166 103V341C194 373 232 392 270 392C337 392 368 351 368 269V103C368 38 360 32 302 26V0H513Z"></path></g><g transform="matrix(.013,0,0,-0.013,10.985,0)"><path d="M181 342V451C133 431 89 419 40 411V388C98 381 102 377 102 311V104C102 38 95 32 33 26V0H263V26C186 32 181 38 181 104V287C203 343 235 372 261 372C277 372 289 366 304 352C310 346 318 345 330 350C349 359 362 379 362 399C362 422 338 449 304 449C256 449 213 393 183 342H181Z"></path></g><g transform="matrix(.013,0,0,-0.013,15.639,0)"><path d="M380 106C343 72 306 56 265 56C195 56 116 112 115 248C235 252 361 262 377 265C396 269 400 277 400 297C400 374 333 449 250 449H249C198 449 144 421 103 376S37 269 37 201C37 88 109 -12 232 -12C263 -12 332 6 395 84L380 106ZM225 412C281 412 315 364 314 312C314 297 308 292 290 292C232 290 176 289 120 289C135 370 180 412 225 412Z"></path></g><g transform="matrix(.013,0,0,-0.013,21.164,0)"><path d="M319 325C317 349 306 409 297 431C277 440 250 449 209 449C117 449 57 389 57 319C57 243 122 209 182 182C232 159 261 135 261 91C261 48 227 21 190 21C130 21 85 79 68 145L41 140C41 104 51 36 58 22C75 7 121 -12 172 -12C252 -12 337 35 337 126C337 195 286 231 210 262C166 281 126 304 126 348C126 388 152 417 191 417C240 417 274 378 294 318L319 325Z"></path></g><g transform="matrix(.013,0,0,-0.013,25.882,0)"><path d="M513 0V26C455 31 447 37 447 103V278C447 398 390 449 309 449C255 449 202 412 166 376V712C127 700 67 684 19 677V653C85 647 87 643 87 580V103C87 37 79 31 19 26L18 0H231V26C171 32 166 39 166 103V341C194 373 232 392 270 392C337 392 368 351 368 269V103C368 38 360 32 302 26V0H513Z"></path></g><g transform="matrix(.013,0,0,-0.013,32.772,0)"><path d="M257 449C165 449 37 374 37 209C37 98 119 -12 256 -12C355 -12 473 65 473 226C473 349 381 449 257 449ZM244 416C333 416 380 320 380 204C380 67 329 21 267 21C184 21 130 115 130 241C130 354 184 416 244 416Z"></path></g><g transform="matrix(.013,0,0,-0.013,39.311,0)"><path d="M238 0V26C174 32 166 38 166 104V712C132 700 70 683 18 677V653C81 647 87 645 87 577V104C87 38 78 32 15 26V0H238Z"></path></g><g transform="matrix(.013,0,0,-0.013,42.6,0)"><path d="M517 51L485 54C448 58 441 63 441 115V712C404 700 337 684 285 678V653C357 648 362 645 362 580V437C339 446 309 449 295 449C159 449 38 340 38 201C38 61 143 -12 223 -12C234 -12 261 -6 301 17L362 53V-12C420 9 495 22 517 26V51ZM362 85C338 67 301 51 266 51C201 51 128 109 128 228C128 373 212 411 259 411C296 411 338 395 362 360V85Z"></path></g><g transform="matrix(.013,0,0,-0.013,53.282,0)"><path d="M535 323V373H52V323H535ZM535 138V188H52V138H535Z"></path></g><g transform="matrix(.013,0,0,-0.013,64.545,0)"><path d="M241 635C89 635 35 457 35 312C35 153 89 -12 240 -12C390 -12 443 166 443 312C443 466 390 635 241 635ZM238 602C329 602 354 454 354 312C354 172 330 22 240 22C152 22 124 173 124 313S148 602 238 602Z"></path></g><g transform="matrix(.013,0,0,-0.013,70.785,0)"><path d="M113 -12C146 -12 170 11 170 46C170 78 146 103 114 103S58 78 58 46C58 11 82 -12 113 -12Z"></path></g><g transform="matrix(.013,0,0,-0.013,73.749,0)"><path d="M137 343C167 482 260 545 321 574C357 591 397 603 429 609L423 641C382 634 335 622 295 608C189 570 37 457 37 238C37 84 125 -12 242 -12C362 -12 447 89 447 209C447 311 374 393 267 393C247 393 226 386 204 376L137 343ZM227 337C318 337 361 256 361 173C361 105 336 22 258 22C176 22 126 120 126 240C126 266 127 291 132 310C155 323 189 337 227 337Z"></path></g></svg>.</span> (c) The distribution of probability p and label when <span class="nowrap"><svg height="9.51429pt" id="M112" style="vertical-align:-0.2063894pt" version="1.1" viewbox="-0.0498162 -9.3079 80.1753 9.51429" width="80.1753pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M298 36L289 62C276 55 253 45 228 45C202 45 169 60 169 141V397H276C289 405 292 426 282 437H169V574L155 576L90 509V437H45L17 408L21 397H90V107C90 28 125 -12 188 -12C198 -12 213 -8 230 1L298 36Z"></path></g><g transform="matrix(.013,0,0,-0.013,4.043,0)"><path d="M513 0V26C455 31 447 37 447 103V278C447 398 390 449 309 449C255 449 202 412 166 376V712C127 700 67 684 19 677V653C85 647 87 643 87 580V103C87 37 79 31 19 26L18 0H231V26C171 32 166 39 166 103V341C194 373 232 392 270 392C337 392 368 351 368 269V103C368 38 360 32 302 26V0H513Z"></path></g><g transform="matrix(.013,0,0,-0.013,10.985,0)"><path d="M181 342V451C133 431 89 419 40 411V388C98 381 102 377 102 311V104C102 38 95 32 33 26V0H263V26C186 32 181 38 181 104V287C203 343 235 372 261 372C277 372 289 366 304 352C310 346 318 345 330 350C349 359 362 379 362 399C362 422 338 449 304 449C256 449 213 393 183 342H181Z"></path></g><g transform="matrix(.013,0,0,-0.013,15.639,0)"><path d="M380 106C343 72 306 56 265 56C195 56 116 112 115 248C235 252 361 262 377 265C396 269 400 277 400 297C400 374 333 449 250 449H249C198 449 144 421 103 376S37 269 37 201C37 88 109 -12 232 -12C263 -12 332 6 395 84L380 106ZM225 412C281 412 315 364 314 312C314 297 308 292 290 292C232 290 176 289 120 289C135 370 180 412 225 412Z"></path></g><g transform="matrix(.013,0,0,-0.013,21.164,0)"><path d="M319 325C317 349 306 409 297 431C277 440 250 449 209 449C117 449 57 389 57 319C57 243 122 209 182 182C232 159 261 135 261 91C261 48 227 21 190 21C130 21 85 79 68 145L41 140C41 104 51 36 58 22C75 7 121 -12 172 -12C252 -12 337 35 337 126C337 195 286 231 210 262C166 281 126 304 126 348C126 388 152 417 191 417C240 417 274 378 294 318L319 325Z"></path></g><g transform="matrix(.013,0,0,-0.013,25.882,0)"><path d="M513 0V26C455 31 447 37 447 103V278C447 398 390 449 309 449C255 449 202 412 166 376V712C127 700 67 684 19 677V653C85 647 87 643 87 580V103C87 37 79 31 19 26L18 0H231V26C171 32 166 39 166 103V341C194 373 232 392 270 392C337 392 368 351 368 269V103C368 38 360 32 302 26V0H513Z"></path></g><g transform="matrix(.013,0,0,-0.013,32.772,0)"><path d="M257 449C165 449 37 374 37 209C37 98 119 -12 256 -12C355 -12 473 65 473 226C473 349 381 449 257 449ZM244 416C333 416 380 320 380 204C380 67 329 21 267 21C184 21 130 115 130 241C130 354 184 416 244 416Z"></path></g><g transform="matrix(.013,0,0,-0.013,39.311,0)"><path d="M238 0V26C174 32 166 38 166 104V712C132 700 70 683 18 677V653C81 647 87 645 87 577V104C87 38 78 32 15 26V0H238Z"></path></g><g transform="matrix(.013,0,0,-0.013,42.6,0)"><path d="M517 51L485 54C448 58 441 63 441 115V712C404 700 337 684 285 678V653C357 648 362 645 362 580V437C339 446 309 449 295 449C159 449 38 340 38 201C38 61 143 -12 223 -12C234 -12 261 -6 301 17L362 53V-12C420 9 495 22 517 26V51ZM362 85C338 67 301 51 266 51C201 51 128 109 128 228C128 373 212 411 259 411C296 411 338 395 362 360V85Z"></path></g><g transform="matrix(.013,0,0,-0.013,53.282,0)"><path d="M535 323V373H52V323H535ZM535 138V188H52V138H535Z"></path></g><g transform="matrix(.013,0,0,-0.013,64.545,0)"><path d="M241 635C89 635 35 457 35 312C35 153 89 -12 240 -12C390 -12 443 166 443 312C443 466 390 635 241 635ZM238 602C329 602 354 454 354 312C354 172 330 22 240 22C152 22 124 173 124 313S148 602 238 602Z"></path></g><g transform="matrix(.013,0,0,-0.013,70.785,0)"><path d="M113 -12C146 -12 170 11 170 46C170 78 146 103 114 103S58 78 58 46C58 11 82 -12 113 -12Z"></path></g><g transform="matrix(.013,0,0,-0.013,73.749,0)"><path d="M249 635C141 635 70 555 70 471C70 401 114 353 179 316C143 294 106 267 90 252C68 231 45 202 45 157C45 50 130 -12 237 -12C322 -12 435 52 435 169C435 256 372 304 303 343C349 374 375 398 383 407C401 429 411 458 411 487C411 569 344 635 249 635ZM238 603C285 603 337 567 337 482C337 422 310 385 276 358C205 393 145 426 145 500C145 552 179 603 238 603ZM248 20C183 20 125 70 125 163C125 218 158 268 206 300C284 261 355 217 355 143C355 66 308 20 248 20Z"></path></g></svg>.</span> (d) The distribution of probability <svg height="10.2124pt" id="M113" style="vertical-align:-3.42943pt" version="1.1" viewbox="-0.0498162 -6.78297 7.83752 10.2124" width="7.83752pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M570 304C570 398 525 448 414 448C385 448 343 445 312 434L329 511L321 518C297 504 262 482 244 460L233 411C195 397 159 381 128 358L135 332C160 347 189 360 224 373L111 -147C97 -210 84 -218 17 -231L13 -257L254 -247L259 -218L233 -216C183 -212 177 -202 189 -142L218 -1C238 -10 266 -12 283 -12C351 3 429 48 483 105C543 168 570 242 570 304ZM482 289C482 161 380 33 304 33C278 33 248 51 233 69L303 396C326 400 352 403 369 403C428 403 482 380 482 289Z"></path></g></svg> and label in ideal situation.</div>

Wireless Communications and Mobile Computing

Valid Probabilistic Anomaly Detection Models for System Logs

Figure 6