AI Based Anomaly Detection in Endpoint Logs

Abstract

Artificial Intelligence (AI) has achieved significant advancements in anomaly identification. Software systems frequently document critical runtime data in system logs for diagnostic purposes. The swift advancement of cybersecurity threats has rendered the detection of anomalies in endpoint logs essential for recognizing potential security breaches. Conventional rule-based detection techniques frequently inadequately identify complex and dynamic assault patterns. Explainable Artificial Intelligence (XAI) enhances the examination of system logs. It employs a white-box model to ensure transparency, comprehensibility, reliability, and dependability of Machine Learning (ML) and Deep Learning (DL) models. The methodology is corroborated using actual endpoint log datasets, exhibiting enhanced accuracy and diminished false positives relative to conventional techniques. The results underscore the capability of AI-driven anomaly detection to improve endpoint security through real-time threat intelligence and adaptive protection strategies.