Anomaly Detection in Cybersecurity Logs Using a Convolutional Autoencoder With 2d Matrix Representation

Abstract

The growing complexity of cyberattacks presents organizations with severe issues that are based on outdated security monitoring infrastructure. Although signature-based intrusion detection systems are effective against catalogued threats, they are essentially reactive and do not identify zero-day exploits, Advanced Persistent Threats or subtle behavioural abnormalities that do not correspond to any predefined rule. The requirement to automate, adapt and unsupervised detection mechanisms has never been more urgent as enterprise networks generate logs on a scale and velocity never before seen. Current machine learning methods, such as One-Class Support Vector Machines, Isolation Forest, and LSTM-based autoencoders, consider cybersecurity log data as a flat sequential vectors or scalar time series. This representation is fundamentally constrained as it loses the structured co-occurrence relations among features that are activated concurrently, relations that tend to contain the most discriminative information towards the distinction of malicious behaviour and normal functioning. To overcome this representational gap, we have suggested an CNN-based autoencoder architecture that encodes sequential log entries into two-dimensional matrix formats and passes them to the detection model. Sliding windows of normalized log vectors are then rearranged into a fixed-size matrix, which effectively represents the temporal and feature-wise relationships as spatial patterns. These matrices are then processed by convolutional layers that extract hierarchical features that include local and global dependencies that one-dimensional processing is unable to reclaim. The autoencoder is only trained using normal traffic data and anomalies are detected at inference time when the reconstruction error surpasses a statistically determined threshold. On the UNSW-NB15 and CICIDS2017 benchmark data, we measure the proposed system with an 80/20 stratified division and 5-fold cross-validation. The model has a detection accuracy of 96.0, preciseness of 95.2, recall of 96.8 and a F1-score of 96.0, which is better than all the four baseline approaches across all measures. These findings indicate that when cybersecurity log analysis is re-framed as a problem of spatial pattern recognition, then meaningful and measurable benefits are obtained and the low per-event inference latency of the system means it is a good candidate to be deployed in operational security monitoring corners.