Towards Anomaly Detection using Multiple Instances of Micro-Cluster Detection

One of the resources used in anomaly detection on log data is graph based approaches. Connections between adjacent log entries, co-occurrence of attributes, and other relations can be easily represented using graphs. In this paper, using a state-of-the-art (SOTA) graph based anomaly detection method, we reproduce and show the limitations on publicly available log data. Then we introduce a novel method, MIMC, that improves on the detection rates without causing a considerable loss in the overall performance. In order to evaluate the performance of MIMC, we perform experiments over the same datasets used in SOTA. The results indicate that MIMC has merit as a graph-based anomaly detection system over different types of log data. We believe that this is an important achievement on the road to building an unsupervised and online approach.