LogBERT Event Embedder
Self-supervised security event embedding and anomaly detection models.
Models Included
| File | Description |
|---|---|
tokenizer.json |
Event type vocabulary (22+ tokens) |
isolation_forest.joblib |
Classical anomaly baseline |
one_class_svm.joblib |
One-class SVM detector |
lof.joblib |
Local Outlier Factor |
pca.joblib |
PCA reconstruction error |
lstm_autoencoder.pt |
LSTM sequence autoencoder |
transformer_event_model.pt |
Transformer masked event model |
contrastive_encoder.pt |
Contrastive session embedder |
Usage
from pathlib import Path
import sys
sys.path.insert(0, "src")
from logbert.pipeline import LogBERTPipeline
pipeline = LogBERTPipeline(model_dir=Path("model"))
result = pipeline.process(open("logs.jsonl").read())
print(result.anomaly_count)
Training
Trained on synthetic endpoint security event sequences. See project README for reproduction.
Limitations
- Synthetic training data; fine-tune on your organization's logs for production
- CPU-optimized small models; scale up for enterprise volume
- Event taxonomy covers common endpoint scenarios
Ethical Considerations
Designed for defensive security monitoring. Do not use for unauthorized surveillance.