Abstract: Techniques are described herein that are capable of detecting an algorithmic attack against a hosted artificial intelligence (AI) system based on inputs (e.g., queries) and outputs of the hosted AI system. In a first example, a feature-based classifier model is used to generate a classification score based on features that are derived from numerical representations of the queries and the outputs, and an algorithmic attack is detected based on the classification score being greater than or equal to a score threshold. In a second example, a transformer-based model is used to generate a vector by providing a multivariate time series, which is based on attribute(s) of the inputs and attribute(s) of the outputs, as an input to the transformer-based model, and an algorithmic attack is detected based on a distance between the vector and a point corresponding to a reference vector being less than or equal to a distance threshold.

Abstract: Examples described herein generally relate to processing event logs where, for each of multiple events in an event log of the one or more event logs, a table of logged event instances can be generated for the event. For each of the multiple events, the table can be processed using an autoencoder to identify one or more of the logged event instances as anomalies, and an indication of at least a portion of the anomalies can be output. In addition, the event logs and/or corresponding tables of events can be used to train models for the autoencoders.

Abstract: According to examples, an apparatus may include a processor and a memory on which is stored machine-readable instructions that when executed by the processor, may cause the processor to access a plurality of features pertaining to an event, apply an anomaly detection model on the accessed plurality of features, in which the anomaly detection model may output a reconstruction of the accessed plurality of features. The processor may calculate a reconstruction error of the reconstruction, determine whether a combination of the plurality of features is anomalous based on the calculated reconstruction error, and based on a determination that the combination of the plurality of features is anomalous, output a notification that the event is anomalous.

Abstract: Examples described herein generally relate to processing event logs where, for each of multiple events in an event log of the one or more event logs, a table of logged event instances can be generated for the event. For each of the multiple events, the table can be processed using an autoencoder to identify one or more of the logged event instances as anomalies, and an indication of at least a portion of the anomalies can be output. In addition, the event logs and/or corresponding tables of events can be used to train models for the autoencoders.