Hybrid Autoencoder–TCN architecture for detecting anomalies in distributed cybersecurity logs

This work presents a hybrid anomaly detection framework for distributed cybersecurity logs that couples an Autoencoder (AE) for representation learning with a Temporal Convolutional Network (TCN) for sequence modeling. The AE compresses high-dimensional log segments into compact latent vectors, enabling denoising and feature extraction. At the same time, the TCN employs dilated causal convolutions to capture long-range temporal dependencies in the latent sequence. A fused anomaly score that combines reconstruction and prediction errors supports threshold-based decisions suitable for streaming deployments. Evaluations on heterogeneous log streams compare the proposed approach with AE-only, TCN-only, and standard sequence baselines (e.g., LSTM/Transformer) using F1, AUROC, and AUPRC, together with operational metrics (throughput and latency) and robustness analyses (ablation and threshold sensitivity). The hybrid model consistently achieves higher detection quality across datasets and maintains sub-second inference under realistic input rates. Ablation results confirm the complementarity of structural (AE) and temporal (TCN) cues, while sensitivity studies indicate stable performance over a wide range of fusion weights and thresholds. These findings suggest that the AE–TCN paradigm offers a scalable and operationally viable detection layer for modern, distributed security monitoring, with practical benefits for SOC/SIEM integration.

Hali tarjima qilinmagan