EventGuard: Anomaly Detection in Windows Event Logs through Automated Machine Learning Techniques.

Abstract

"EventGuard enhances Windows event log analysis for security by employing machine learning, particularly deep learning-based solutions. It evaluates five widely used neural networks within three cutting-edge techniques for log-based anomaly identification. This proactive defense against cyberattacks enables early risk identification and response, contributing valuable insights to the field and emphasizing the critical role of log analysis in addressing evolving security threats. The methodology of EventGuard revolves around assessing machine learning modules, focusing on deep learning-based solutions. It explores the effectiveness of five commonly deployed neural networks within three techniques designed for log-based anomaly identification. EventGuard not only provides proactive defense against cyber threats but also enhances the overall security posture of computer systems. By contributing insights to anomaly identification in Windows event logs, EventGuard underscores the significance of log analysis in mitigating security threats."