alirezaaminzadeh/logbert-event-embedder

LogBERT Event Embedder

Self-supervised security event embedding and anomaly detection models.

Models Included

File	Description
tokenizer.json	Event type vocabulary (22+ tokens)
isolation_forest.joblib	Classical anomaly baseline
one_class_svm.joblib	One-class SVM detector
lof.joblib	Local Outlier Factor
pca.joblib	PCA reconstruction error
lstm_autoencoder.pt	LSTM sequence autoencoder
transformer_event_model.pt	Transformer masked event model
contrastive_encoder.pt	Contrastive session embedder

Usage

from pathlib import Path
import sys
sys.path.insert(0, "src")
from logbert.pipeline import LogBERTPipeline

pipeline = LogBERTPipeline(model_dir=Path("model"))
result = pipeline.process(open("logs.jsonl").read())
print(result.anomaly_count)

Training

Trained on synthetic endpoint security event sequences. See project README for reproduction.

Limitations

• Synthetic training data; fine-tune on your organization's logs for production
• CPU-optimized small models; scale up for enterprise volume
• Event taxonomy covers common endpoint scenarios

Ethical Considerations

Designed for defensive security monitoring. Do not use for unauthorized surveillance.