SigML++: Supervised Log Anomaly with Probabilistic Polynomial Approximations

Log collection and storage is a crucial process for enterprises around the globe. Log analysis helps identify potential security breaches and, in some cases, is required by law for compliance. However, enterprises often delegate these responsibilities to third-party Cloud Service Providers (CSPs), where the logs are collected and processed for anomaly detection and stored in a data warehouse for archiving. Prevalent schemes rely on plain (unencrypted) data for anomaly detection. More often, these logs can reveal sensitive information about an organization or the customers of that organization. Hence, it is best to keep it encrypted at all times. This paper presents "SigML++," an extension of work done in "SigML." We utilize Fully Homomorphic Encryption (FHE) with the Cheon-Kim-Kim-Song (CKKS) scheme for supervised log anomaly detection on encrypted data. We use an Artificial Neural Network (ANN) based probabilistic polynomial approximations using a Perceptron with linear activation. We probabilistically approximate the Sigmoid activation function (σ(x)) in the encrypted domain for the intervals [−10,10] and [−50,50]. Experiments show better approximations for Logistic Regression (LR) and Support Vector Machine (SVM) for low-order polynomials.