Saved in:
| Main Authors: | , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2025
|
| Subjects: | |
| Online Access: | https://arxiv.org/abs/2509.06911 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866916940074713088 |
|---|---|
| author | Ferreira, Margarida Nicolet, Victor Pham, Luan Dodds, Joey Kroening, Daniel Lynce, Ines Martins, Ruben |
| author_facet | Ferreira, Margarida Nicolet, Victor Pham, Luan Dodds, Joey Kroening, Daniel Lynce, Ines Martins, Ruben |
| contents | We propose HyGLAD, a novel algorithm that automatically builds a set of interpretable patterns that model event data. These patterns can then be used to detect event-based anomalies in a stationary system, where any deviation from past behavior may indicate malicious activity. The algorithm infers equivalence classes of entities with similar behavior observed from the events, and then builds regular expressions that capture the values of those entities. As opposed to deep-learning approaches, the regular expressions are directly interpretable, which also translates to interpretable anomalies. We evaluate HyGLAD against all 7 unsupervised anomaly detection methods from DeepOD on five datasets from real-world systems. The experimental results show that on average HyGLAD outperforms existing deep-learning methods while being an order of magnitude more efficient in training and inference (single CPU vs GPU). Precision improved by 1.2x and recall by 1.3x compared to the second-best baseline. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2509_06911 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Hypergraph-Guided Regex Filter Synthesis for Event-Based Anomaly Detection Ferreira, Margarida Nicolet, Victor Pham, Luan Dodds, Joey Kroening, Daniel Lynce, Ines Martins, Ruben Software Engineering Machine Learning We propose HyGLAD, a novel algorithm that automatically builds a set of interpretable patterns that model event data. These patterns can then be used to detect event-based anomalies in a stationary system, where any deviation from past behavior may indicate malicious activity. The algorithm infers equivalence classes of entities with similar behavior observed from the events, and then builds regular expressions that capture the values of those entities. As opposed to deep-learning approaches, the regular expressions are directly interpretable, which also translates to interpretable anomalies. We evaluate HyGLAD against all 7 unsupervised anomaly detection methods from DeepOD on five datasets from real-world systems. The experimental results show that on average HyGLAD outperforms existing deep-learning methods while being an order of magnitude more efficient in training and inference (single CPU vs GPU). Precision improved by 1.2x and recall by 1.3x compared to the second-best baseline. |
| title | Hypergraph-Guided Regex Filter Synthesis for Event-Based Anomaly Detection |
| topic | Software Engineering Machine Learning |
| url | https://arxiv.org/abs/2509.06911 |