I work on security detection at Datadog. The model I have been building, Mambark, reads audit logs the way a language model reads text and scores every event by how surprising it is. It is a small model by today’s standards, about 97 million parameters, and it looks at hundreds of billions of security events instead of sentences.
Read in full here: