## 1 Introduction  
It is essential to dive into the foundations of log-based systems as the classification of malicious activities is performed using machine learning. Logs are run-time details about systems that are kept in the computer as plain text. This information may be used to examine system behavior for assisting developers and engineers with system development. It includes user behavior, as well as any operations that are carried out inside the computer system. Malicious activity is defined as user conduct that might damage the system, data, or network. Logs are essential for the creation, upkeep, and improvement of the fundamental architecture of software systems. Researchers have come up with novel mechanisms such as log-based anomaly detection for extracting features and detecting anomalies with higher performance and efficiency [1]. Typically, the system preserves comprehensive data in log files, enabling developers and system engineers to identify system behaviors and potential future issues [2]. Because log files provide extensive information, researchers may use them to assess system flaws that aid in diagnosing activities such as anomalous behavior, statistical analysis, application security, system performance identification, and crash and error diagnostics [3]. Anomalies in log data indicate probable system faults and are crucial for performance and application issue troubleshooting. Finding the timing and location of an issue in an application may be performed using logs and timestamp information [4]. Large volumes of logs are frequently produced by modern software systems (in the event of a cloud-based program, around 1 GB of data each hour). A practical manual examination of log messages for essential diagnostic data is not feasible. The objective of this log analysis is to find unusual activities and possible security risks. The term \"abnormal behavior\" applies to both attack-related activity and typical behavior of the computer or network. In a typical standalone system, the administrator must personally analyze the system to find anomalies. These anomalies may be found using a code search or standard string matching, but human inspection is still necessary in many cases. For large-scale systems, these techniques are insufficient [5]. Over the last 10 years, academics, developers, and commercial providers have focused on anomaly detection technologies such as automated system log analysis to help the end-user. However, the majority of earlier detection systems used certain patterns and a priori information to find anomalies in the system log. These techniques are limited to recognized attacks. These algorithms are unable to handle all of the difficulties in contemporary systems. Figure 1 shows a summary of the log data related to a specific system used in this research work. The figure shows events of different applications that occurred in the system. When analyzing system log data, unusual activity should be seen as distinct patterns or traits that should not be followed by ordinary or customary actions throughout the complete operation. According to [PERSON], \"outliers\" are aberrant observations that seem to diverge considerably from other members of the sample in which they occur. There are certain issues with log data that make it difficult to find anomalies [4]. Redundant runtime data, unstructured plain text, large imbalance data, and anomalies come in three different flavors: \"point anomalies\", \"contextual anomalies\", and \"collective anomalies\". A point anomaly refers to data that fully deviated from the normal or average distribution of all other data points [6]. The system also generates this data; a significant change is limited to certain data points and has some contextual information in common with the other points or average data. Data points O\({}_{1}\) and O\({}_{2}\) in Figure 2 stand for point anomalies.