Powered by OpenAIRE graph
Found an issue? Give us feedback
addClaim

AnomaLog: An Auditable Framework for Reproducing Log Anomaly Detection Experiments

Authors: Samarasinghe, Haren;

AnomaLog: An Auditable Framework for Reproducing Log Anomaly Detection Experiments

Abstract

AnomaLog is a research artefact for reconstructing, executing, and auditing log anomaly detection experiments under explicit experimental assumptions. It was developed for an MEng dissertation on the reproducibility and comparability of published log anomaly detection and security-event analysis results, using DeepLog and DeepCASE as case studies. The framework treats a reported benchmark result as a claim about a complete experimental protocol, rather than as a detector score in isolation. It records dataset contracts, parsing and event-key construction choices, sequence and split semantics, detector settings, metric scopes, counted populations, exclusions, abstentions, environment metadata, and run artefacts. This is intended to make reproduction gaps localisable to corpus construction, preprocessing, sequence construction, label projection, detector behaviour, or evaluation semantics. This release contains the AnomaLog code and experiment infrastructure used to run the dissertation evaluation. It includes configurable dataset and model registries, DeepLog and DeepCASE adapters, diagnostic comparators, metric blocks for next-event prediction, anomaly detection, and workload reduction, and reporting artefacts for paper-facing reproductions, best-effort reconstructions, benchmark extensions, and sanity checks. The archive should be cited together with the corresponding dissertation and, where applicable, the associated curated result artefacts. It is not intended as a general-purpose anomaly-detection leaderboard; results produced by the framework should be interpreted under their declared AnomaLog experiment contracts.

  • BIP!
    Impact byBIP!
    selected citations
    These citations are derived from selected sources.
    This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
    0
    popularity
    This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.
    Average
    influence
    This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
    Average
    impulse
    This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.
    Average
Powered by OpenAIRE graph
Found an issue? Give us feedback
selected citations
These citations are derived from selected sources.
This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
BIP!Citations provided by BIP!
popularity
This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.
BIP!Popularity provided by BIP!
influence
This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).
BIP!Influence provided by BIP!
impulse
This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.
BIP!Impulse provided by BIP!
0
Average
Average
Average