Database Log Anomaly Detection Using SLM’s

Abstract

: Rapid growth in volume and complexity of system logs in modern computing environments requires efficient anomaly detection to identify potential system failures, security breaches, or performance issues. This paper introduces a novel approach to detecting anomalies in system logs using Small Language Models (SLMs). We utilize the Mini-LM model to convert unstructured log messages from the Hadoop Distributed File System (HDFS) and Android datasets into 384-dimensional semantic embeddings, capturing contextual relationships. These embeddings are combined with numerical features, including time differences and categorical encoded metadata, and processed by an Isolation Forest algorithm with a contamination rate of 0.2 to classify anomalies. A baseline model, using only process and thread identifiers, serves as a pseudo-ground truth for evaluation. The lightweight and modular pipeline ensures scalability and adaptability, making it suitable for real-time enterprise log analysis.