Drone Flight Log Anomaly Severity Classification via Sentence Embedding

Log-based anomaly detection is one of the popular research topics in the cybersecurity domain. Typically, the log event classification target is only separated into two classes: normal and anomaly. However, the abnormality might contain words or phrases that determine the importance level of the anomalies. Therefore, this paper proposes to extend anomaly detection into log anomaly severity classification, which consists of four classes, i.e., normal, low, medium, and high. As an initial study, several machine learning models are used to build the detection models. A dataset is constructed to verify and evaluate the models' performance by manually annotating drone flight log messages collected from two public drone flight log datasets. Since machine learning models cannot understand natural language, sentence embedding is used as the feature extractor. It embeds the messages into sentence-level vector embeddings to represent the linguistic features in the log message. The micro-average F1 score is selected as the main evaluation metric, considering the proportion between classes in the dataset is imbalanced. After experimenting with the models with 5-fold cross-validation, the multilayer perceptron outperforms the other models and obtains the highest F1 score of 94.788%. The proposed approach successfully recognizes and detects anomalous events in the drone's flight log data with a promising result.