{"id":"https://openalex.org/W7212330484","doi":null,"title":"LOG-BASED SEMI-SUPERVISED ANOMALY DETECTION AND EXPLANATION USING TEMPORAL VISUAL REPRESENTATIONS AND LLMS","display_name":"LOG-BASED SEMI-SUPERVISED ANOMALY DETECTION AND EXPLANATION USING TEMPORAL VISUAL REPRESENTATIONS AND LLMS","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7212330484"},"language":"en","primary_location":{"id":"pmh:oai:www.doria.fi:10024/195589","doi":null,"is_oa":true,"landing_page_url":"https://www.doria.fi/handle/10024/195589","pdf_url":"https://www.doria.fi/bitstream/10024/195589/2/cirkovic_masa.pdf","source":{"id":"https://openalex.org/S4377196760","display_name":"Doria (University of Helsinki)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I133731052","host_organization_name":"University of Helsinki","host_organization_lineage":["https://openalex.org/I133731052"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Diplomarbete"},"volume":null,"type":"other","is_traditional":false,"indexed_in":[],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://www.doria.fi/bitstream/10024/195589/2/cirkovic_masa.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5151364084","display_name":"Masa Cirkovic","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Cirkovic, Masa","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5151364084"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8682000041007996,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8682000041007996,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.12319999933242798,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.0015999999595806003,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/log-based-anomaly-detection","display_name":"log anomaly detection","score":0.796999990940094},{"id":"https://openalex.org/keywords/semi-supervised-anomaly-detection","display_name":"semi-supervised anomaly detection","score":0.8109999895095825},{"id":"https://openalex.org/keywords/attack-classification","display_name":"attack classification","score":0.5789999961853027},{"id":"https://openalex.org/keywords/slowloris","display_name":"Slowloris","score":0.9290000200271606},{"id":"https://openalex.org/keywords/security-incident-detection","display_name":"security incident detection","score":0.6340000033378601}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6302000284194946},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.6021000146865845},{"id":"https://openalex.org/C118505674","wikidata":"https://www.wikidata.org/wiki/Q42586063","display_name":"Encoder","level":2,"score":0.5274999737739563},{"id":"https://openalex.org/C2776157432","wikidata":"https://www.wikidata.org/wiki/Q1375683","display_name":"Normality","level":2,"score":0.48510000109672546},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.4465999901294708},{"id":"https://openalex.org/C100660578","wikidata":"https://www.wikidata.org/wiki/Q18733","display_name":"Recall","level":2,"score":0.4185999929904938},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.39910000562667847},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.37450000643730164},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.36579999327659607},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.35249999165534973},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.3434000015258789},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.3366999924182892},{"id":"https://openalex.org/C99138194","wikidata":"https://www.wikidata.org/wiki/Q183427","display_name":"Hash function","level":2,"score":0.3346000015735626},{"id":"https://openalex.org/C28490314","wikidata":"https://www.wikidata.org/wiki/Q189436","display_name":"Speech recognition","level":1,"score":0.31779998540878296},{"id":"https://openalex.org/C2779227376","wikidata":"https://www.wikidata.org/wiki/Q6505497","display_name":"Layer (electronics)","level":2,"score":0.31040000915527344},{"id":"https://openalex.org/C202269582","wikidata":"https://www.wikidata.org/wiki/Q2644277","display_name":"Complementarity (molecular biology)","level":2,"score":0.29350000619888306},{"id":"https://openalex.org/C125411270","wikidata":"https://www.wikidata.org/wiki/Q18653","display_name":"Encoding (memory)","level":2,"score":0.28940001130104065},{"id":"https://openalex.org/C81669768","wikidata":"https://www.wikidata.org/wiki/Q2359161","display_name":"Precision and recall","level":2,"score":0.28459998965263367},{"id":"https://openalex.org/C188198153","wikidata":"https://www.wikidata.org/wiki/Q1613840","display_name":"Limiting","level":2,"score":0.2761000096797943},{"id":"https://openalex.org/C161615301","wikidata":"https://www.wikidata.org/wiki/Q309396","display_name":"Keystroke logging","level":2,"score":0.26910001039505005},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.26010000705718994},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.259799987077713},{"id":"https://openalex.org/C28719098","wikidata":"https://www.wikidata.org/wiki/Q44946","display_name":"Point (geometry)","level":2,"score":0.2551000118255615},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.25110000371932983}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:www.doria.fi:10024/195589","doi":null,"is_oa":true,"landing_page_url":"https://www.doria.fi/handle/10024/195589","pdf_url":"https://www.doria.fi/bitstream/10024/195589/2/cirkovic_masa.pdf","source":{"id":"https://openalex.org/S4377196760","display_name":"Doria (University of Helsinki)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I133731052","host_organization_name":"University of Helsinki","host_organization_lineage":["https://openalex.org/I133731052"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Diplomarbete"},{"id":"pmh:oai:DiVA.org:mdh-78969","doi":null,"is_oa":true,"landing_page_url":"http://urn.kb.se/resolve?urn=urn:nbn:se:mdh:diva-78969","pdf_url":null,"source":{"id":"https://openalex.org/S7407055280","display_name":"H\u00f6gskolan Kristianstad Publikationer","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/bachelorThesis"}],"best_oa_location":{"id":"pmh:oai:www.doria.fi:10024/195589","doi":null,"is_oa":true,"landing_page_url":"https://www.doria.fi/handle/10024/195589","pdf_url":"https://www.doria.fi/bitstream/10024/195589/2/cirkovic_masa.pdf","source":{"id":"https://openalex.org/S4377196760","display_name":"Doria (University of Helsinki)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I133731052","host_organization_name":"University of Helsinki","host_organization_lineage":["https://openalex.org/I133731052"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Diplomarbete"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7212330484.pdf","grobid_xml":"https://content.openalex.org/works/W7212330484.grobid-xml"},"referenced_works_count":39,"referenced_works":["https://openalex.org/W1593045043","https://openalex.org/W1832693441","https://openalex.org/W1978394996","https://openalex.org/W2064675550","https://openalex.org/W2098914003","https://openalex.org/W2114053493","https://openalex.org/W2117897510","https://openalex.org/W2122646361","https://openalex.org/W2144211451","https://openalex.org/W2163499595","https://openalex.org/W2282821441","https://openalex.org/W2560021099","https://openalex.org/W2743138268","https://openalex.org/W2754051771","https://openalex.org/W2754665629","https://openalex.org/W2767094836","https://openalex.org/W2884697754","https://openalex.org/W2898998129","https://openalex.org/W2900708792","https://openalex.org/W2947815220","https://openalex.org/W2965838158","https://openalex.org/W3040197085","https://openalex.org/W3047881323","https://openalex.org/W3092771185","https://openalex.org/W3180050267","https://openalex.org/W3199174176","https://openalex.org/W4226002507","https://openalex.org/W4226128225","https://openalex.org/W4308118173","https://openalex.org/W4309939034","https://openalex.org/W4323655380","https://openalex.org/W4360978672","https://openalex.org/W4376288669","https://openalex.org/W4387487536","https://openalex.org/W4400135851","https://openalex.org/W4401667316","https://openalex.org/W4402437224","https://openalex.org/W4402858692","https://openalex.org/W4405861053"],"related_works":["https://openalex.org/W4319993380","https://openalex.org/W7128365161","https://openalex.org/W7167088601","https://openalex.org/W7203930109","https://openalex.org/W7161156960","https://openalex.org/W4416251915","https://openalex.org/W4382119071","https://openalex.org/W7165630372","https://openalex.org/W4382023244","https://openalex.org/W7220852534"],"abstract_inverted_index":{"Cloud":[0],"infrastructure":[1],"logs":[2,134],"are":[3,40,73,92],"the":[4,21,28,117,162,213,223,227],"primary":[5],"signal":[6],"for":[7,153,240,260],"detecting":[8],"security":[9],"incidentsin":[10],"modern":[11],"deployments.":[12],"Automated":[13],"analysis":[14],"is":[15,59,121,186],"complicated":[16],"by":[17],"high":[18],"log":[19,56,79,90,183,249,262],"volume,":[20,45],"absence":[22],"of":[23,30,55,88,242],"labelled":[24],"attack":[25,126,225,235],"examples,":[26],"and":[27,58,101,105,135,172,176,192,254],"existence":[29],"collective":[31],"anomalies":[32],"\u2014":[33,94,104],"attacks":[34,63,180],"that":[35,64,181],"appear":[36],"individually":[37],"normal":[38,113],"but":[39,185],"anomalous":[41],"in":[42],"their":[43],"aggregate":[44],"timing,":[46],"or":[47,69],"co-occurrence.":[48],"The":[49,156,165,194,231],"dominant":[50],"unsupervised":[51],"approach":[52],"models":[53],"sequences":[54,184],"events":[57],"structurally":[60],"blind":[61,188,200],"to":[62,189,207,257],"alter":[65,182],"only":[66],"how":[67,70],"much":[68],"slowly":[71],"requests":[72],"made.":[74],"This":[75],"thesis":[76],"investigates":[77],"image-based":[78,195,248],"encoding":[80,250],"as":[81,116,251],"a":[82,106,138,252],"complementary":[83],"detection":[84],"paradigm.":[85],"Five":[86],"representations":[87],"time-windowed":[89],"bins":[91],"designed":[93],"capturing":[95],"endpoint":[96],"access":[97,133],"frequencies,":[98],"token":[99,202],"co-occurrence,":[100],"spectral":[102],"content":[103],"video":[107],"Transformer":[108],"encoder":[109,196],"trained":[110],"exclusively":[111],"on":[112,123,178,209,222],"traffic":[114],"serves":[115],"normality":[118],"model.":[119],"Detection":[120],"evaluated":[122],"seven":[124,243],"synthetic":[125],"scenarios":[127],"injected":[128],"into":[129],"real":[130],"OpenStack":[131],"Keystone":[132],"benchmarked":[136],"against":[137],"sequence-based":[139],"baseline":[140,167,214,228],"under":[141],"two":[142,163],"temporal":[143],"configurations.":[144],"A":[145],"large-language-model":[146],"(LLM)":[147],"explanation":[148],"layer":[149,233],"produces":[150],"natural-language":[151],"reports":[152],"flagged":[154],"bins.":[155],"results":[157,246],"confirm":[158],"near-perfect":[159],"complementarity":[160],"between":[161,174],"paradigms.":[164],"sequential":[166,258],"achieves":[168,204],"AUC":[169],"above":[170],"0.988":[171],"F1":[173],"0.471":[175],"0.727":[177],"five":[179],"effectively":[187],"API":[190,210],"abuse":[191,211],"Slowloris.":[193],"covers":[197],"exactly":[198],"those":[199],"spots:":[201],"frequency":[203],"recall":[205,221],"up":[206],"0.962":[208],"where":[212,226],"records":[215,229],"below":[216],"0.04;":[217],"co-occurrence":[218],"reaches":[219],"0.610":[220],"timing-based":[224],"zero.":[230],"LLM":[232],"classifies":[234],"types":[236],"with":[237],"perfect":[238],"accuracy":[239],"four":[241],"types.":[244],"These":[245],"establish":[247],"viable":[253],"replicable":[255],"complement":[256],"detectors":[259],"comprehensive":[261],"anomaly":[263],"detection.":[264]},"counts_by_year":[],"updated_date":"2026-11-08T12:12:28.789561","created_date":"2026-09-12T00:00:00"}