{"id":222153,"date":"2021-05-12T11:55:15","date_gmt":"2021-05-12T09:55:15","guid":{"rendered":"https:\/\/www.intrinsec.com\/?p=222153"},"modified":"2021-05-12T11:55:15","modified_gmt":"2021-05-12T09:55:15","slug":"log-loss-machine-learning","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/log-loss-machine-learning\/","title":{"rendered":"Log loss detection and machine learning: a possible use case with AI?"},"content":{"rendered":"

For SOC<\/a> analysts, it is very important to know when a loss of logs is occurring or may have occurred<\/strong>. When SIEMs no longer receive logs from its usual sending hosts, the detection\/correlation rules cannot be properly applied<\/strong>. It is then likely in this type of scenario, that there is a late awareness or even a total absence of awareness<\/strong> by the analysts if one or more security incidents could have occurred<\/strong>. The same is true if an attacker has managed to take control of a host or user account to stop all logging processes<\/strong> so that his illegitimate behavior goes unnoticed<\/strong>.<\/p>\n\n\n\n

Artificial intelligence<\/strong> is seen as a very beneficial advance to our society, allowing us to predict our needs<\/strong> and thus respond with anticipation<\/strong>n. Its ability to understand and analyze a given context can help detect anomalies or unusual behaviors<\/strong> and thus, can it strengthen the detection<\/strong> for the case of lost logs on hosts? This is what we will discover in this article, which is broken down into five parts:<\/p>\n\n\n\n

\n
\n
\n
\n
  1. Existing calculation methods<\/li>
  2. Application of machine learning in Splunk with MLTK<\/li>
  3. Limitations of detection with MLTK<\/li>
  4. Another more classical and cognitive approach<\/li>
  5. The advantages and disadvantages<\/li><\/ol>\n<\/div><\/div>\n<\/div><\/div>\n<\/div><\/div>\n<\/div><\/div>\n\n\n\n

    Existing calculation methods<\/h1>\n\n\n\n

    Considering the very negative effect that lost logs can have on the security of a company's systems, it is essential to know how to detect them. There are three methods<\/strong> that can be used to solve this problem.<\/p>\n\n\n\n

    1st method: fixed threshold<\/h2>\n\n\n\n

    This method consists of estimating and defining a fixed maximum time threshold for the non-receipt of logs<\/strong> globally or for each host. As soon as an entry exceeds the threshold, the alert is triggered<\/strong>.<\/p>\n\n\n\n

    This approach can be effective but the thresholds may not be accurately matched to the variation in host log appearance during certain periods<\/strong>, and therefore too high a tolerance may be applied or vice versa<\/strong>. This is an approach that ends up requiring critical analysis by analysts, so it is not as effective and reliable<\/strong> because it can trigger a lot of false alerts or ignore log losses<\/strong> where there should be none.<\/p>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    2nd method: standard deviation<\/h2>\n\n\n\n

    The standard deviation method, which consists of calculating the variation in the appearance of logs around the historical average<\/strong> to define more precise automated thresholds<\/strong> in globally or for each host.<\/p>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    While this may seem to limit the problems arising from the first method<\/strong> outlined above, an effective limitation<\/strong> may occur when there is a trend or seasonality<\/strong> to the disappearance of logs from a host. Tea historical average<\/strong> will not accurately represent the true average<\/strong> for a given period of time and, as a result, the calculated thresholds may not properly detect possible log loss<\/strong>.<\/p>\n\n\n\n

    3rd method: the error of the standard deviation<\/h2>\n\n\n\n

    The method of the error of the standard deviation which is similar to the previous one<\/strong> but which aims at calculating the forecast error allowing to obtain an average error<\/strong>. It allows to know several standard deviations for the definition of several thresholds for several periods for each host.<\/p>\n\n\n\n

    \"\"<\/figure><\/div>\n\n\n\n

    This smarter detection<\/strong> method analyzes the forecast error variance instead of simply monitoring the occurrence of logs around the historical average, and thus detects threshold overruns much more accurately and reduces them to a more plausible value<\/strong>. Therefore, this method is best<\/strong> to address the problem of log loss detection and can be directly employed and adapted<\/strong> through Splunk's MLTK application<\/strong>.<\/p>\n\n\n\n

    Application of machine learning in Splunk with MLTK<\/h1>\n\n\n\n

    What is MLTK?<\/h2>\n\n\n\n

    Machine Learning Toolkit<\/strong> is a free<\/strong> application that installs on the Splunk platform to extend its functionality and provide a guided machine learning modeling environment<\/strong> with:<\/p>\n\n\n\n

    • A showcase with a machine learning toolbox<\/strong>. It contains ready-to-use examples with real datasets<\/strong> to quickly and easily understand how the methods and algorithms available work<\/strong>.<\/li>
    • Year experimentation assistant<\/strong> to design in a guided way your own models and test them.<\/li>
    • An SPL search tab integrating MLTK's own commands<\/strong> allowing you to test and adapt your own models.<\/li>
    • 43 algorithms available and usable<\/strong> directly from the application and also a python library<\/strong> containing several hundred open source algorithms<\/strong> for numerical computation in free access.<\/li><\/ul>\n\n\n\n

      MLTK can therefore meet different objectives such as:<\/p>\n\n\n\n

      • Predict numerical fields (linear regression)<\/li>
      • Predict categorical fields (logistic regression)<\/li>
      • Detect numerical outliers (distribution statistics)<\/li>
      • Detect categorical outliers (probabilistic measures)<\/li>
      • Time series forecasting<\/li>
      • Clustering numerical events<\/li><\/ul>\n\n\n\n
        \"\"<\/figure><\/div>\n\n\n\n

        Among the aforementioned objectives that MLTK can satisfy, only one machine learning model can address the detection of log loss with the error of the standard deviation methodd: outlier detection<\/strong>.<\/p>\n\n\n\n

        Outlier detection for missing hosts<\/h2>\n\n\n\n

        Outlier detection is the identification of data that deviates from a data set<\/strong>. To obtain the data in this use case, it is sufficient to record the time difference between each log<\/strong> issued by the host and to clean the null values<\/strong> that may distort the results. Then, we calculate the error of the standard deviation for each of the data to detect the outliers<\/strong>.<\/p>\n\n\n\n

        Here is an example of a prediction model in MLTK on log loss for a single host. Tea outliers<\/strong> (yellow dots<\/strong>) are the data points that fall outside the outer envelope<\/strong> (light blue area<\/strong>). The value on the right side of the graph (14<\/strong>) indicates the total number of outliers<\/strong> :<\/p>\n\n\n\n

        \"\"<\/figure><\/div>\n\n\n\n

        We notice that the outlier envelope<\/strong> or the calculated thresholds follow rather well the general shape of the curve<\/strong> but that a certain number of outliers are still found<\/strong>.<\/p>\n\n\n\n

        Limitation of detection with MLTK<\/h1>\n\n\n\n

        While this method allows for the seasonality of log loss<\/strong>, it still requires some consistency<\/strong>. Some hosts may transmit very irregularly during any period<\/strong> and thus create false outliers<\/strong> in the data sets. <\/p>\n\n\n\n

        For example, this is the case for this host which, over a period of 2 to 30 days, will keep a high coefficient of variation<\/strong>. This coefficient corresponds to the relative measure of the dispersion of the data around the mean<\/strong> It is equal to the ratio of the standard deviation to the mean<\/strong>. The higher the value of the coefficient of variation, the greater the dispersion around the mean<\/strong>. Below, the coefficients of variation are greater than 1.5, ie the standard deviation is more than 1.5 times the mean. A standard deviation is considered to be high when it is half the mean<\/strong>, so it is relatively high in this example:<\/p>\n\n\n\n

        Periods<\/strong><\/td>2 days<\/strong><\/td>7_days<\/strong><\/td>14 days<\/strong><\/td>21 days<\/strong><\/td>30 days<\/strong><\/td><\/tr><\/thead>
        Total Frequency<\/td>144<\/td>404<\/td>902<\/td>1338<\/td>1921<\/td><\/tr>
        Total Population (xf)<\/td>258591<\/td>688776<\/td>1295373<\/td>1900168<\/td>2653629<\/td><\/tr>
        Median (\u03bc)<\/td>600<\/td>600<\/td>600<\/td>600<\/td>600<\/td><\/tr>
        Average (\u2d1f)<\/td>1795.77<\/td>1708.09<\/td>1436.11<\/td>1420.16<\/td>1381.38<\/td><\/tr>
        x min<\/td>598<\/td>580<\/td>559<\/td>559<\/td>559<\/td><\/tr>
        x max<\/td>28799<\/td>28799<\/td>31199<\/td>37204<\/td>37204<\/td><\/tr>
        Standard Deviation (\u03c3)<\/td>3301<\/td>2869<\/td>2416<\/td>2446<\/td>2304<\/td><\/tr>
        Coefficient of variation<\/td>1.84<\/td>1.68<\/td>1.68<\/td>1.72<\/td>1.67<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

        The same is true if you focus on specific days of the week over a 30-day period:<\/p>\n\n\n\n

        Periods<\/strong><\/td>Monday<\/strong><\/td>Tuesday<\/strong><\/td>Wednesday<\/strong><\/td>Thursday<\/strong><\/td>Friday<\/strong><\/td>Saturday<\/strong><\/td>Sunday<\/strong><\/td><\/tr><\/thead>
        Total frequency<\/td>403<\/td>403<\/td>356<\/td>328<\/td>268<\/td>90<\/td>73<\/td><\/tr>
        Total population<\/td>431224<\/td>407397<\/td>344989<\/td>346248<\/td>390887<\/td>383993<\/td>386387<\/td><\/tr>
        Median<\/td>600<\/td>600<\/td>600<\/td>600<\/td>601<\/td>2104.5<\/td>3000<\/td><\/tr>
        Average<\/td>1070.03<\/td>1010.91<\/td>969.07<\/td>1055.63<\/td>1318.62<\/td>4266.59<\/td>5292.97<\/td><\/tr>
        Minimum value<\/td>595<\/td>559<\/td>580<\/td>592<\/td>594<\/td>590<\/td>598<\/td><\/tr>
        Maximum value<\/td>7200<\/td>7200<\/td>8400<\/td>10800<\/td>8399<\/td>37204<\/td>31199<\/td><\/tr>
        Standard deviation<\/td>988<\/td>835<\/td>794<\/td>1056<\/td>1379<\/td>5771<\/td>6871<\/td><\/tr>
        Coefficient of variation<\/td>0.92<\/td>0.83<\/td>0.82<\/td>1.00<\/td>1.05<\/td>1.35<\/td>1.30<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

        Moreover, for entries that are very verbose<\/strong>, has performance demand on the SIEM side is also important<\/strong> during the different calculations because of a too large number of logs<\/strong>. It is then necessary to reduce the learning period<\/strong> of the model, thus impacting the reliability of the calculated thresholds<\/strong>, because the longer the learning period<\/strong>, the more data it allows to store<\/strong> and therefore to predict better thresholds<\/strong>.<\/p>\n\n\n\n

        Finally, it is very difficult with this solution to apply this model to a set of hosts<\/strong>. Each input emits logs in its own way<\/strong> and it is therefore mandatory to adjust the calculations for each input for this model to work correctly<\/strong>. This case-by-case adjustment can be a considerable workload if several hundred or even thousands of hosts need to be monitored<\/strong>.<\/p>\n\n\n\n

        Another more classical and cognitive approach<\/h1>\n\n\n\n

        Observing that the cognitive solution can detect threshold violations much more precisely and at more plausible values, it is no less restrictive<\/strong>. Indeed, this solution requires a certain regularity in the data<\/strong>, a long learning period and thus a significant computing power<\/strong> and the ability to refine the calculations on a case by case basis<\/strong>.<\/p>\n\n\n\n

        To overcome these different constraints, another approach<\/strong>, more classical<\/strong> and based on the idea of a cognitive solution<\/strong>, was thought and designed for a general application on a set of hosts.<\/p>\n\n\n\n

        It consists first of all in relying on the counting of events<\/strong> rather than on the calculation of the time difference between each event. This change of parameter is very important because even if the type of data is not the same, the computational power required is much less important<\/strong> and thus allows a longer learning period<\/strong>.<\/p>\n\n\n\n

        This model then performs statistics<\/strong> to apply a minimum threshold for each host based on their verbosity level over several time slots<\/strong>. Coefficients<\/strong> are then applied to these thresholds based on the variation in values<\/strong> that may have been measured in the past in order to refine and obtain a specific threshold for each host at a specific time<\/strong>. Although this way of calculating thresholds can be considered more arbitrary<\/strong>, it is no less accurate<\/strong> than the machine learning method. In addition, it allows you to keep control of the log loss tolerance<\/strong> and to refine the thresholds on a case-by-case basis for a set of hosts<\/strong>.<\/p>\n\n\n\n

        The advantages and disadvantages<\/h1>\n\n\n\n

        All current systems generate event logs, the volume of which varies over time<\/strong> (notably according to their activity) which creates a certain variability<\/strong>. As a result, there is no completely reliable method<\/strong> of detecting log loss. Regardless of the nature of this variance, many external factors<\/strong> can occur that can severely affect the reliability<\/strong> of the method used. Log losses are often the result of external events, such as collection agent or transmission API malfunction<\/strong>, machine decommissioning or reboots<\/strong>, which may be due to infrastructure, system or software constraints that temporarily make log collection impossible.<\/p>\n\n\n\n

        Even if machine learning is in the news a lot at the moment because important progress has been made in this field and it could have been a good axis of improvement to answer this problem. The way it is presented often leads us to believe that it is capable of answering any problem as long as a context has been well defined<\/strong> and there is the presence of data<\/strong>. But this is obviously not the case. Although machine learning allows to increase detection rates<\/strong>, to detect attacks as early as possible<\/strong> and to improve the ability to adapt to changes<\/strong>, machines are constantly learning<\/strong>.<\/p>\n\n\n\n

        In most cases, machine learning is a clever combination of technology and human intervention<\/strong>. For this reason, the more traditional approach better fits the context of this use case<\/strong>. Indeed, whether with MLTK or another machine learning solution, it is difficult to predict the data<\/strong> and to obtain acceptable confidence thresholds for each host<\/strong> because of the large variability<\/strong> that remains between them.<\/p>","protected":false},"excerpt":{"rendered":"

        For SOC analysts, it is very important to know when a loss of logs is [\u2026]<\/p>","protected":false},"author":36,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[],"class_list":["post-222153","post","type-post","status-publish","format-standard","hentry","category-soc-securite-operationnelle"],"yoast_head":"\nLog loss detection and machine learning: a possible use case with AI? - INTRINSEC<\/title>\n<meta name=\"description\" content=\"Artificial intelligence is seen as a very beneficial advance to our society, allowing us to predict our needs and thus respond with anticipation. Its ability to understand and analyze a given context can help detect anomalies or unusual behaviors and thus, can it strengthen the detection for the case of lost logs on hosts?\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intrinsec.com\/en\/log-loss-machine-learning\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Log loss detection and machine learning: a possible use case with AI?\" \/>\n<meta property=\"og:description\" content=\"Artificial intelligence is seen as a very beneficial advance to our society, allowing us to predict our needs and thus respond with anticipation. Its ability to understand and analyze a given context can help detect anomalies or unusual behaviors and thus, can it strengthen the detection for the case of lost logs on hosts?\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intrinsec.com\/en\/log-loss-machine-learning\/\" \/>\n<meta property=\"og:site_name\" content=\"INTRINSEC\" \/>\n<meta property=\"article:published_time\" content=\"2021-05-12T09:55:15+00:00\" \/>\n<meta name=\"author\" content=\"Tristan Pigeon\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Tristan Pigeon\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/log-loss-machine-learning\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/log-loss-machine-learning\\\/\"},\"author\":{\"name\":\"Tristan Pigeon\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/f40051481d9f9edccc9bf8ac004ca187\"},\"headline\":\"Log loss detection and machine learning: a possible use case with AI?\",\"datePublished\":\"2021-05-12T09:55:15+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/log-loss-machine-learning\\\/\"},\"wordCount\":1780,\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/log-loss-machine-learning\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2021\\\/05\\\/1-1.png\",\"articleSection\":[\"SOC S\u00e9curit\u00e9 Op\u00e9rationnelle\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/log-loss-machine-learning\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/log-loss-machine-learning\\\/\",\"name\":\"Log loss detection and machine learning: a possible use case with AI? - INTRINSEC\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/log-loss-machine-learning\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/log-loss-machine-learning\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2021\\\/05\\\/1-1.png\",\"datePublished\":\"2021-05-12T09:55:15+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/f40051481d9f9edccc9bf8ac004ca187\"},\"description\":\"Artificial intelligence is seen as a very beneficial advance to our society, allowing us to predict our needs and thus respond with anticipation. Its ability to understand and analyze a given context can help detect anomalies or unusual behaviors and thus, can it strengthen the detection for the case of lost logs on hosts?\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/log-loss-machine-learning\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/log-loss-machine-learning\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/log-loss-machine-learning\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2021\\\/05\\\/1-1.png\",\"contentUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2021\\\/05\\\/1-1.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/log-loss-machine-learning\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.intrinsec.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Log loss detection and machine learning: a possible use case with AI?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"name\":\"INTRINSEC\",\"description\":\"Notre m\u00e9tier , Prot\u00e9ger le v\u00f4tre\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.intrinsec.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/f40051481d9f9edccc9bf8ac004ca187\",\"name\":\"Tristan Pigeon\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"caption\":\"Tristan Pigeon\"},\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/author\\\/tristan-pigeon\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Log loss detection and machine learning: a possible use case with AI? - INTRINSEC","description":"Artificial intelligence is seen as a very beneficial advance to our society, allowing us to predict our needs and thus respond with anticipation. Its ability to understand and analyze a given context can help detect anomalies or unusual behaviors and thus, can it strengthen the detection for the case of lost logs on hosts?","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intrinsec.com\/en\/log-loss-machine-learning\/","og_locale":"en_US","og_type":"article","og_title":"Log loss detection and machine learning: a possible use case with AI?","og_description":"Artificial intelligence is seen as a very beneficial advance to our society, allowing us to predict our needs and thus respond with anticipation. Its ability to understand and analyze a given context can help detect anomalies or unusual behaviors and thus, can it strengthen the detection for the case of lost logs on hosts?","og_url":"https:\/\/www.intrinsec.com\/en\/log-loss-machine-learning\/","og_site_name":"INTRINSEC","article_published_time":"2021-05-12T09:55:15+00:00","author":"Tristan Pigeon","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Tristan Pigeon","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.intrinsec.com\/log-loss-machine-learning\/#article","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/log-loss-machine-learning\/"},"author":{"name":"Tristan Pigeon","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/f40051481d9f9edccc9bf8ac004ca187"},"headline":"Log loss detection and machine learning: a possible use case with AI?","datePublished":"2021-05-12T09:55:15+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intrinsec.com\/log-loss-machine-learning\/"},"wordCount":1780,"image":{"@id":"https:\/\/www.intrinsec.com\/log-loss-machine-learning\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2021\/05\/1-1.png","articleSection":["SOC S\u00e9curit\u00e9 Op\u00e9rationnelle"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.intrinsec.com\/log-loss-machine-learning\/","url":"https:\/\/www.intrinsec.com\/log-loss-machine-learning\/","name":"Log loss detection and machine learning: a possible use case with AI? - INTRINSEC","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.intrinsec.com\/log-loss-machine-learning\/#primaryimage"},"image":{"@id":"https:\/\/www.intrinsec.com\/log-loss-machine-learning\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2021\/05\/1-1.png","datePublished":"2021-05-12T09:55:15+00:00","author":{"@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/f40051481d9f9edccc9bf8ac004ca187"},"description":"Artificial intelligence is seen as a very beneficial advance to our society, allowing us to predict our needs and thus respond with anticipation. Its ability to understand and analyze a given context can help detect anomalies or unusual behaviors and thus, can it strengthen the detection for the case of lost logs on hosts?","breadcrumb":{"@id":"https:\/\/www.intrinsec.com\/log-loss-machine-learning\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intrinsec.com\/log-loss-machine-learning\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/log-loss-machine-learning\/#primaryimage","url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2021\/05\/1-1.png","contentUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2021\/05\/1-1.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.intrinsec.com\/log-loss-machine-learning\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.intrinsec.com\/"},{"@type":"ListItem","position":2,"name":"Log loss detection and machine learning: a possible use case with AI?"}]},{"@type":"WebSite","@id":"https:\/\/www.intrinsec.com\/#website","url":"https:\/\/www.intrinsec.com\/","name":"INTRINSEC","description":"Our job is to protect yours.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intrinsec.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/f40051481d9f9edccc9bf8ac004ca187","name":"Tristan Pigeon","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","caption":"Tristan Pigeon"},"url":"https:\/\/www.intrinsec.com\/en\/author\/tristan-pigeon\/"}]}},"_links":{"self":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/222153","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/users\/36"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/comments?post=222153"}],"version-history":[{"count":0,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/222153\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media?parent=222153"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/categories?post=222153"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/tags?post=222153"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}