## 7 Conclusions  
In our article, we discussed the problem of detecting anomalies in system log files using an approach known from the NLP domain. We described an improved version of the  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline  & \multicolumn{2}{c}{**F1-Score**} & \multicolumn{2}{c}{**AUC**} \\ \hline
**Classifier** & **LogEvent2 Vec** & **Our Approach** & **LogEvent2 Vec** & **Our Approach** \\ \hline GNB & 0.778 (\(W=5000\)) & 0.612 (\(W=10\)) & 0.929 (\(W=5000\)) & 0.973 (\(W=10\)) \\ RF & 0.886 (\(W=5000\)) & 0.994 (\(W=5\)) & 0.959 (\(W=5000\)) & 0.993 (\(W=5\)) \\ MLP & 0.829 (\(W=5000\)) & 0.994 (\(W=5\)) & 0.911 (\(W=5000\)) & 0.994 (\(W=5\)) \\ \hline \hline \end{tabular}
\end{table}
Table 3: Evaluation metrics’ comparison with LogEvent2 Vec (\(W\) denotes the window length for which the best results were obtained).  
LogEvent2 Vec algorithm, presented first in [9]. We proposed a significant shortening of the analysis window, which both increased the accuracy of anomaly detection and made further analysis of suspicious sequences much easier. In contrast to the original paper, we experimented with various classifiers, such as GNB, DT, XB, RF, AB, and MLP. We showed that selecting an optimal classifier (in this case, MLP) and a short log sequence gave an excellent result. The improved version of the algorithm yielded the best F1-score of 0.997, compared to 0.886 in the original version of the algorithm.  
Future work on this topic may include incorporating feedback from system administrators. The administrator, after manual verification of sequences marked by the model as anomalous, would have a set of false-positive sequences that could be used to retrain the model so that similar sequences are marked correctly in the future. We also plan to test our approach using other open-source log datasets, such as HDFS [47], Thunderbird, and Spirit [40], to verify how general our method is.  
Moreover, further work may involve adapting the architecture so that the learning process runs on anomaly-free data. As a result, the model will learn the normal operation of the system, and thus be able to determine which logs stand out from these characteristics. Such an approach, presented by the authors of DeepLog [24], would allow for the detection of new types of anomalies in the analyzed systems.  
Conceptualization, P.R. and A.J.; methodology, P.R., K.W. and A.J.; software, P.R.; validation, P.R., K.W. and A.J.; formal analysis, P.R.; investigation, P.R. and A.J.; resources, P.R.; data curation, P.R.; writing--original draft preparation, P.R., K.W. and A.J.; writing--review and editing, P.R., K.W. and A.J.; visualization, P.R.; supervision, A.J.; project administration, A.J.; funding acquisition, A.J. All authors have read and agreed to the published version of the manuscript.  
This research was supported by the SIMARGL Project-Secure Intelligent Methods for Advanced RecoGnition of malware and stegomalware, with the support of the European Commission and the Horizon 2020 Program, under Grant Agreement No. 833042.  
Not applicable.  
The code used for experiments is publicly available at [[https://github.com/Vold01/LogAnomalyDetection](https://github.com/Vold01/LogAnomalyDetection)]([https://github.com/Vold01/LogAnomalyDetection](https://github.com/Vold01/LogAnomalyDetection)) (accessed on 12 May 2022).  
The authors declare no conflict of interest.