Anomaly Detection in Application Logs with Attention Mechanism-Enhanced LSTM

As digital technology continues to spread across various sectors, the need for robust cybersecurity becomes increasingly critical. One way to ensure security is by identifying potential threats and anomalies through application log analysis. Traditional methods that rely only on rule-based detection are often insufficient to adapt to new attack patterns. This research addresses these limitations by integrating rule-based detection with Sigma rules into the ELK (Elasticsearch, Logstash, Kibana) platform to generate a structured dataset. Logs are collected from monitored applications and categorized into normal, system anomalies, or user anomalies. A modified long short-term memory (lstm) model with an attention mechanism is trained on the labeled dataset to improve anomaly detection. Experimental results show that the LSTM model with the attention mechanism achieves the highest performance, with an accuracy of 98.52%, precision of 98.66%, recall of 98.52%, and an F1-score of $\mathbf{9 8. 5 5 \%}$, outperforming RNN, GRU, and standard LSTM models in anomaly detection.