Automatic and scalable log pattern learning in security log analysis

1. A computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method for implementing automatic and scalable log pattern learning in security log analysis, comprising:

collecting security logs generated by one or more management services of a computer system;

implementing an incremental learning process to generate a set of log patterns from the collected security logs; and

parsing the collected security logs using the set of log patterns;

wherein implementing the incremental learning process to generate the set of log patterns further comprises:

defining a first set as the training set, a second set as a set of log patterns that have been generated, and a third set as a set of logs of the training set that lack a matching pattern in the second set;

sampling the third set to generate a fourth set having a size corresponding to a parameter controlling a maximum resource requirement for the incremental learning process;

performing automatic log pattern recognition to generate a fifth set; and

performing a log filtering process based on the fifth set.

2. The computer program product as recited in claim 1 , wherein performing the automatic log pattern recognition further comprises:

tokenizing logs of the fourth set to generate tokens from the logs of the fourth set;

applying a similarity measurement on the logs to capture similarities among the logs of the fourth set;

implementing a hierarchical clustering algorithm to generate a log cluster hierarchy for the logs of the fourth set;

aligning the logs of the fourth set within each cluster associated with a given level of the log cluster hierarchy;

conducting log motif discovery on the aligned logs to find log motifs; and

performing pattern recognition from the log motifs by recognizing one or more log fields.

3. The computer program product as recited in claim 1 , wherein performing the log filtering process further comprises:

determining if the fifth set is empty;

in response to determining that the fifth set is empty:

updating the third set by subtracting the fourth set from the third set;

in response to determining that the updated third set is empty, outputting the second set; and

in response to determining that the updated third set includes at least one log, updating the fourth set by sampling the updated third set, and updating the fifth set by performing automatic pattern recognition using the updated fourth set; and

in response to determining that the fifth set includes at least one log pattern:

updating the second set by adding the fifth set to the second set;

updating the third set with logs identified in the third set that lack a matching pattern in the second set;

in response to determining that the updated third set is empty, outputting the updated second set; and

in response to determining that the updated third set includes at least one log, updating the fourth set by sampling the updated third set, and updating the fifth set by performing automatic pattern recognition using the updated fourth set.

4. The computer program product as recited in claim 3 , further comprising using a log parser to identify the logs in the third set that lack a matching pattern in the second set.