Methods and systems for efficiently detecting and recording security anomalies

Abstract

In certain examples, an anomaly detection stage involves building an anomalous embedding database. A log embedding is extracted from an input security log using trained machine learning (ML). An anomaly detection method is used to identify the log embedding as anomalous. The log embedding is not necessarily added to the log embedding database. Rather, it is compared with existing anomalous log embeddings already stored in the anomalous embedding database, and is only added to the database if it does not match any of the existing anomalous log embeddings. Once populated, the anomalous embedding database may be used to support threat detection and mitigation in a deployment stage.