Multiclass Classification of Anomalous States of Computer Systems by Means of Intellectual Analysis of System Journals

摘要

The increasing importance of analyzing log files in large computer systems requires the development of automated methods for processing unstructured data to extract relevant information from large-scale log files without the need for human intervention. Analysis of unstructured system log data shows that anomalous events in computer systems can be represented in groups due to different causes of their occurrence. As a result, the task of identifying the types of anomalous states of computer systems is reduced not to binary, but to multi-class classification and can be solved by machine learning methods. Given that the number of anomalous events is generally small, it is advisable to use both "abnormal" and "normal" events to teach machine learning algorithms. As a result, the process of classifying the type of anomaly is reduced to a two-stage diagram. The first stage solves the problem of binary classification, which results in two classes: 1 - "anomaly" or 0 - "normal event." The second stage solves the task of assessing a particular type of anomaly.