Performance evaluation of anomaly detection in imbalanced system log data

An administrator needs to examine operating system log files for any anomalous events. In real-life log data, the number of anomalies is often smaller than the normal ones. This imbalance situation affects the performance of the anomaly detectors because a large number of normal events feed the training of the classifier. In this paper, we evaluate popular machine learning methods and consider this problem of data imbalance. We compare data oversampling and undersampling approaches before inputting them to the classifier. Experimental results demonstrate that by taking data imbalance into consideration, there is an improvement in the method performance in terms of precision and recall scores.