Linux log anomaly detection method based on improved isolated forest algorithm

Abstract

In order to efficiently and correctly identify abnormal behaviors in Linux logs, this paper proposes a Linux log anomaly detection method based on the improved isolated forest algorithm. The method introduces an attention mechanism on the basis of the isolated forest algorithm, which can dynamically adjust the attention features and sample points when processing log data, and dynamically adjust the degree of attention according to the degree of abnormality of the samples. Experimental results show that the method achieves high efficiency in the Linux log anomaly detection task compared with traditional methods, and can effectively discover potential security threats and abnormal behaviors.

Keywords

• anomaly detection|linux log data|isolated forests|attention mechanisms