Instructions to use AungMoonLord/bert-log-anomaly-detection with libraries, inference providers, notebooks, and local apps. Follow these links to get started.
- Libraries
- Transformers
How to use AungMoonLord/bert-log-anomaly-detection with Transformers:
# Use a pipeline as a high-level helper from transformers import pipeline pipe = pipeline("text-classification", model="AungMoonLord/bert-log-anomaly-detection")# Load model directly from transformers import AutoTokenizer, AutoModelForSequenceClassification tokenizer = AutoTokenizer.from_pretrained("AungMoonLord/bert-log-anomaly-detection") model = AutoModelForSequenceClassification.from_pretrained("AungMoonLord/bert-log-anomaly-detection") - Notebooks
- Google Colab
- Kaggle
proofread and translated Thai texts to English
#2
by warissripatoomrak - opened
README.md
CHANGED
|
@@ -16,11 +16,11 @@ pipeline_tag: text-classification
|
|
| 16 |
<!-- Provide a quick summary of what the model is/does. -->
|
| 17 |
Model Summary
|
| 18 |
|
| 19 |
-
1. bert-log-anomaly-detection is a BERT-based NLP model fine-tuned for single SQL transaction log anomaly detection.
|
| 20 |
|
| 21 |
-
2. The model classifies each database transaction log as either Normal or Anomaly, with the goal of supporting AI-powered fraud detection and cybersecurity monitoring systems.
|
| 22 |
|
| 23 |
-
3. This model was developed as part of the
|
| 24 |
|
| 25 |
|
| 26 |
### Model Description
|
|
@@ -41,7 +41,7 @@ Demo: Hackathon prototype
|
|
| 41 |
|
| 42 |
<!-- Provide the basic links for the model. -->
|
| 43 |
|
| 44 |
-
- **Repository:** https://github.com/AungMoonLord/AI-Cybersecurity-Hackathon/tree/main/New%20Finetune%20Hackathon
|
| 45 |
|
| 46 |
### How to Get Started with the Model
|
| 47 |
|
|
@@ -59,10 +59,11 @@ tokenizer = BertTokenizer.from_pretrained(MODEL_PATH)
|
|
| 59 |
|
| 60 |
model.eval()
|
| 61 |
```
|
| 62 |
-
|
|
|
|
| 63 |
```python
|
| 64 |
-
#
|
| 65 |
-
def add_prefix_token(text): # log data
|
| 66 |
# clean log
|
| 67 |
text = text.replace("\t", " ")
|
| 68 |
text = text.strip()
|
|
@@ -72,7 +73,8 @@ def add_prefix_token(text): # log data ต้องผ่าน code นี้
|
|
| 72 |
else:
|
| 73 |
return "[LOG]\n" + text
|
| 74 |
```
|
| 75 |
-
|
|
|
|
| 76 |
```python
|
| 77 |
def predict_log(log_text):
|
| 78 |
log_text = add_prefix_token(log_text)
|
|
@@ -80,7 +82,7 @@ def predict_log(log_text):
|
|
| 80 |
log_text,
|
| 81 |
return_tensors="pt",
|
| 82 |
truncation=True,
|
| 83 |
-
padding=True, #
|
| 84 |
max_length=128
|
| 85 |
)
|
| 86 |
|
|
@@ -89,19 +91,20 @@ def predict_log(log_text):
|
|
| 89 |
pred = torch.argmax(logits, dim=1).item()
|
| 90 |
prob = torch.softmax(logits, dim=-1).tolist()[0]
|
| 91 |
|
| 92 |
-
return "Normal" if pred == 1 else "Anomaly"
|
| 93 |
```
|
| 94 |
-
|
|
|
|
| 95 |
```python
|
| 96 |
-
#
|
| 97 |
text1 = "SELECT * FROM users WHERE id = 1 OR 1=1"
|
| 98 |
print(predict_log(text1))
|
| 99 |
|
| 100 |
-
#
|
| 101 |
text2 = "2025-01-06 14:23:45 | User: anonymous | IP: 203.154.89.102 | Duration: 0.05s SELECT * FROM users WHERE username = 'admin' OR '1'='1' -- ' AND password = 'x'"
|
| 102 |
print(predict_log(text2))
|
| 103 |
|
| 104 |
-
#
|
| 105 |
text3 = "3051-06-22T07:20:02.296945Z 3 Query select e3mJKDCCY from 7Q8SpG8LLEWhrfpe4s5 where ph4d = 'a1S9hQa92uC1EAyJf2Y';"
|
| 106 |
print(predict_log(text3))
|
| 107 |
```
|
|
@@ -124,9 +127,9 @@ print(predict_log(text3))
|
|
| 124 |
## Training Data
|
| 125 |
|
| 126 |
|
| 127 |
-
- SQL database transaction logs 1,611
|
| 128 |
|
| 129 |
-
- Each log labeled as Normal or Anomaly
|
| 130 |
|
| 131 |
- Data prepared for single-log classification
|
| 132 |
|
|
@@ -145,4 +148,5 @@ print(predict_log(text3))
|
|
| 145 |
|
| 146 |
|
| 147 |
#### Summary
|
| 148 |
-
|
|
|
|
|
|
| 16 |
<!-- Provide a quick summary of what the model is/does. -->
|
| 17 |
Model Summary
|
| 18 |
|
| 19 |
+
1. `bert-log-anomaly-detection` is a BERT-based NLP model fine-tuned for single SQL transaction log anomaly detection.
|
| 20 |
|
| 21 |
+
2. The model classifies each database transaction log as either `Normal` or `Anomaly`, with the goal of supporting AI-powered fraud detection and cybersecurity monitoring systems.
|
| 22 |
|
| 23 |
+
3. This model was developed as part of the _Samsung × KBTG Digital Fraud Cybersecurity Hackathon_ (Thailand) under the AI-Powered Fraud Detection & Prevention track.
|
| 24 |
|
| 25 |
|
| 26 |
### Model Description
|
|
|
|
| 41 |
|
| 42 |
<!-- Provide the basic links for the model. -->
|
| 43 |
|
| 44 |
+
- **GitHub Repository:** https://github.com/AungMoonLord/AI-Cybersecurity-Hackathon/tree/main/New%20Finetune%20Hackathon
|
| 45 |
|
| 46 |
### How to Get Started with the Model
|
| 47 |
|
|
|
|
| 59 |
|
| 60 |
model.eval()
|
| 61 |
```
|
| 62 |
+
|
| 63 |
+
## Step 2 (Clean and Label Logs) — Do not pass this step!
|
| 64 |
```python
|
| 65 |
+
# Perfom log preprocessing
|
| 66 |
+
def add_prefix_token(text): # log data must pass this code before training/inferencing
|
| 67 |
# clean log
|
| 68 |
text = text.replace("\t", " ")
|
| 69 |
text = text.strip()
|
|
|
|
| 73 |
else:
|
| 74 |
return "[LOG]\n" + text
|
| 75 |
```
|
| 76 |
+
|
| 77 |
+
## Step 3 (Create the Function for Log Classification)
|
| 78 |
```python
|
| 79 |
def predict_log(log_text):
|
| 80 |
log_text = add_prefix_token(log_text)
|
|
|
|
| 82 |
log_text,
|
| 83 |
return_tensors="pt",
|
| 84 |
truncation=True,
|
| 85 |
+
padding=True, # for cases when the inference contains more than 1 log, i.e., batch size > 1
|
| 86 |
max_length=128
|
| 87 |
)
|
| 88 |
|
|
|
|
| 91 |
pred = torch.argmax(logits, dim=1).item()
|
| 92 |
prob = torch.softmax(logits, dim=-1).tolist()[0]
|
| 93 |
|
| 94 |
+
return "Normal" if pred == 1 else "Anomaly", prob
|
| 95 |
```
|
| 96 |
+
|
| 97 |
+
## Step 4 (Samples of Inferences)
|
| 98 |
```python
|
| 99 |
+
# Example 1
|
| 100 |
text1 = "SELECT * FROM users WHERE id = 1 OR 1=1"
|
| 101 |
print(predict_log(text1))
|
| 102 |
|
| 103 |
+
# Example 2
|
| 104 |
text2 = "2025-01-06 14:23:45 | User: anonymous | IP: 203.154.89.102 | Duration: 0.05s SELECT * FROM users WHERE username = 'admin' OR '1'='1' -- ' AND password = 'x'"
|
| 105 |
print(predict_log(text2))
|
| 106 |
|
| 107 |
+
# Example 3
|
| 108 |
text3 = "3051-06-22T07:20:02.296945Z 3 Query select e3mJKDCCY from 7Q8SpG8LLEWhrfpe4s5 where ph4d = 'a1S9hQa92uC1EAyJf2Y';"
|
| 109 |
print(predict_log(text3))
|
| 110 |
```
|
|
|
|
| 127 |
## Training Data
|
| 128 |
|
| 129 |
|
| 130 |
+
- SQL database transaction logs (1,611 samples) generated from ChatGPT, Qwen, DeepSeek, Grok, Gemini, and Claude
|
| 131 |
|
| 132 |
+
- Each log labeled as either `Normal` or `Anomaly`
|
| 133 |
|
| 134 |
- Data prepared for single-log classification
|
| 135 |
|
|
|
|
| 148 |
|
| 149 |
|
| 150 |
#### Summary
|
| 151 |
+
|
| 152 |
+
The model demonstrates strong anomaly detection capability with high recall, making it suitable for fraud detection and cybersecurity use cases.
|