SCVS Detector

The Sequence Count Vector Set Detector (SCVS) detects anomalies by finding count vectors that were not present in the training dataset.

	Schema	Description
Input	ParserSchema	Structured log
Output	DetectorSchema	Alert / finding

Description

A count vector is formed by counting the number of appearance of each event ID in a sequence of a specific window size.

Count vectors learned during training are stored via persistency, so a trained model can be saved and restored with a persist: block. A count vector is only comparable within the window it was counted over, so restoring state at a different window_size logs a warning — the restored vectors cannot match and every window would alert.

Configuration example

detectors:
    SCVSDetector:
        method_type: scvs_detector
        window_size: 10

Example usage

from detectmatelibrary.detectors.scvs_detector import SCVSDetector
import detectmatelibrary.schemas as schemas

cfg = {
    "detectors": {
        "SCVSDetector": {
            "method_type": "scvs_detector",
            "auto_config": False,
        }
    }
}
detector = SCVSDetector(name="SCVSDetector", config=cfg)

parser_data = schemas.ParserSchema({
    "parserType": "test",
    "EventID": 1,
    "template": "test template",
    "variables": ["var1"],
    "logID": "1",
    "parsedLogID": "1",
    "parserID": "test_parser",
    "log": "test log message",
    "logFormatVariables": {"timestamp": "123456"}
})


alert = detector.process(parser_data)

Go back Index