Multi-Stage Defense: Enhancing Robustness in Sequence-Based Log Anomaly Detection

Sequence-based deep learning models are commonly used to detect anomalies in system logs to ensure the security of communication and information systems. However, recent research has shown that adversarial attack methods against these detection models reveal their vulnerabilities. Attackers can bypass these sequence-based classifiers by tampering with the sequence (e.g., adding or replacing sequence events). In this paper, we propose a novel Multi-Stage Defensive strategy for sequence-based log anomaly detection aimed at combating adversarial attacks. Systematically integrated, this strategy spans the entire detection process, from data embedding representation to anomaly classification, thereby forming a robust defensive approach that is strategically orchestrated to ensure comprehensive protection against a variety of adversarial attacks. Firstly, we compress the semantic feature space of sequences to enhance the anti-interference ability of attack operations on substitution sequences. Then, we propose a novel adaptive sparse multi-head attention mechanism to improve the Transformer model, allowing it to adaptively extract different key patterns in the sequence, thus eliminating irrelevant sequence events added in adversarial sequences. Our approach also integrates the learning of temporal patterns, offering enhanced robustness against deletion operations. Through extensive experiments on two public datasets, the experimental results demonstrate that our approach has high detection performance and robustness against different adversarial attacks.