Logarithm::AbstractModel

Abstract base class for machine learning models.

Models are the core anomaly detection component in Logarithm. They learn patterns from normal log data during training and detect anomalies during inference by measuring how well they can reconstruct input data.

Anomaly Detection Principle

The unsupervised anomaly detection works as follows:

1. Training: Model learns to reconstruct normal log patterns
2. Inference: Model tries to reconstruct new logs
3. Detection: Reconstruction error indicates anomaly likelihood
4. Thresholding: Errors above threshold trigger alerts

Role in Pipeline

Models are the third stage in the anomaly detection pipeline:

1. Log sources provide raw text
2. Vectorizers convert text to vectors
3. Models learn patterns and detect anomalies
4. Pipeline applies thresholds and generates alerts

Interface

All models must implement:

• train(data, epochs): Learn patterns from training vectors
• predict(input): Reconstruct input vector (inference)
• Save/load methods for model persistence

Example Implementation

class SimpleModel < AbstractModel
  @weights = [] of Array(Float32)

  def train(data : Array(Tensor), epochs : Int32)
    # Implement training algorithm
    epochs.times do
      data.each do |sample|
        # Update weights based on reconstruction error
        prediction = predict(sample)
        error = sample - prediction
        # Gradient descent update...
      end
    end
  end

  def predict(input : Tensor) : Tensor
    # Reconstruct input using learned weights
    # Return best approximation of input
    Tensor.new([0.0_f32]) # Placeholder
  end

  # Implement save/load methods...
end

Built-in Implementations

• Autoencoder: Neural network autoencoder for pattern learning