# 06 - Behavioral Anomaly Detection: ML Models for Log Data

ML models for behavioral anomaly detection on logs: feature engineering, isolation forest, autoencoder and baseline modeling.

## What you'll learn

- Quality feature engineering matters more than algorithm choice
- Isolation Forest is the starting point for log anomaly detection: fast, scalable, unsupervised
- Autoencoders complement IF for contextual and complex anomalies
- SHAP is essential for making anomalies interpretable to analysts
- Rolling baseline prevents the model from becoming stale as behaviors evolve

*This article is part of the **Detection Engineering** series on federicocalo.dev.*

---

## Read the full article

The complete article (28 min read) with code examples, diagrams, and practical exercises is available here:

**➡️ [06 - Behavioral Anomaly Detection: ML Models for Log Data](https://federicocalo.dev/en/blog/behavioral-anomaly-detection-ml-models-log-data)**

`https://federicocalo.dev/en/blog/behavioral-anomaly-detection-ml-models-log-data`

---

*By [Federico Calò](https://federicocalo.dev) — Software Developer & Technical Writer*