Normality Shift Identification for Anomaly Detection of Windows Event Logs

Anomaly detection in network traffic is becoming increasingly difficult with increasing network complexity. Deep learning-based models, such as Autoencoder, are widely used to detect anomalies in normal data. However, when there is a shift in normality, these models fail to recognize new data patterns. This study highlights the importance of overcoming such challenges, particularly in Windows event logs, where changes in data distribution can cause anomaly detection failure. This study focuses on identifying normality shift in Windows event logs and overcomes the limitations of asymmetric Kullback-Leibler Divergence (KLD) using symmetric Jensen-Shannon Divergence (JSD) and Hellinger Distance (HD). The proposed method can measure distribution differences more evenly and accurately. The experimental results demonstrate that normality shift affect model performance. The performance of the anomaly detection model improved after testing the data distribution and filtering out outliers or anomalies that caused the distribution shift. KLD and JSD detect shift in the ranges of 0.0-0.2, 0.4-0.6, and 0.8-1.0. However, JSD detects less shift than KLD due to its symmetrical nature. The HD method more accurately detected shift after filtering because of its sensitivity to small differences in both distributions.