# Topological Data Analysis for Anomaly Detection in Host-Based Logs

arXiv: https://arxiv.org/abs/2204.12919 · HTML: https://mlsanity.com/paper/2204.12919/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 16 references that are in the map.
- First posted on arXiv 25 Apr 2022.

## Builds on (most cited first, 4 of 4)

- [SciPy 1.0--Fundamental Algorithms for Scientific Computing in Python](https://mlsanity.com/paper/1907.10121/) (2019)
- [Trees, forests, and impurity-based variable importance](https://mlsanity.com/paper/2001.04295/) (2020)
- [Directional Laplacian Centrality for Cyber Situational Awareness](https://mlsanity.com/paper/2008.04357/) (2020)
- [A Review of Topological Data Analysis for Cybersecurity](https://mlsanity.com/paper/2202.08037/) (2022)

## Built on by (most cited first, 1 of 1)

- [Reliable Malware Analysis and Detection using Topology Data Analysis](https://mlsanity.com/paper/2211.01535/) (2022)

## Abstract (arXiv)

Topological Data Analysis (TDA) gives practioners the ability to analyse the global structure of cybersecurity data. We use TDA for anomaly detection in host-based logs collected with the open-source Logging Made Easy (LME) project. We present an approach that builds a filtration of simplicial complexes directly from Windows logs, enabling analysis of their intrinsic structure using topological tools. We compare the efficacy of persistent homology and the spectrum of graph and hypergraph Laplacians as feature vectors against a standard log embedding that counts events, and find that topological and spectral embeddings of computer logs contain discriminative information for classifying anomalous logs that is complementary to standard embeddings. We end by discussing the potential for our methods to be used as part of an explainable framework for anomaly detection.