AnomaLog: An Auditable Framework for Reproducing Log Anomaly Detection Experiments

AnomaLog is a research artefact for reconstructing, executing, and auditing log anomaly detection experiments under explicit experimental assumptions. It was developed for an MEng dissertation on the reproducibility and comparability of published log anomaly detection and security-event analysis results, using DeepLog and DeepCASE as case studies.

The framework treats a reported benchmark result as a claim about a complete experimental protocol, rather than as a detector score in isolation. It records dataset contracts, parsing and event-key construction choices, sequence and split semantics, detector settings, metric scopes, counted populations, exclusions, abstentions, environment metadata, and run artefacts. This is intended to make reproduction gaps localisable to corpus construction, preprocessing, sequence construction, label projection, detector behaviour, or evaluation semantics.

This release contains the AnomaLog code and experiment infrastructure used to run the dissertation evaluation. It includes configurable dataset and model registries, DeepLog and DeepCASE adapters, diagnostic comparators, metric blocks for next-event prediction, anomaly detection, and workload reduction, and reporting artefacts for paper-facing reproductions, best-effort reconstructions, benchmark extensions, and sanity checks.

The archive should be cited together with the corresponding dissertation and, where applicable, the associated curated result artefacts. It is not intended as a general-purpose anomaly-detection leaderboard; results produced by the framework should be interpreted under their declared AnomaLog experiment contracts.