06 - Behavioral Anomaly Detection: ML Models for Log Data

ML models for behavioral anomaly detection on logs: feature engineering, isolation forest, autoencoder and baseline modeling.

What you'll learn

• Quality feature engineering matters more than algorithm choice
• Isolation Forest is the starting point for log anomaly detection: fast, scalable, unsupervised
• Autoencoders complement IF for contextual and complex anomalies
• SHAP is essential for making anomalies interpretable to analysts
• Rolling baseline prevents the model from becoming stale as behaviors evolve

This article is part of the Detection Engineering series on federicocalo.dev.

Read the full article

The complete article (28 min read) with code examples, diagrams, and practical exercises is available here:

➡️ 06 - Behavioral Anomaly Detection: ML Models for Log Data

https://federicocalo.dev/en/blog/behavioral-anomaly-detection-ml-models-log-data

By Federico Calò — Software Developer & Technical Writer