State Machine Guided Multi-Relational Synthetic Data from Logs for Anomaly Detection

State Machine Guided Multi-Relational Synthetic Data from Logs for Anomaly Detection

Source: cs.MA updates on arXiv.org — https://arxiv.org/abs/2606.00531 Date read: 2026-06-06 Connected to: none Escalation: store-only Escalation rationale:

What this is

A method paper proposing automated recovery of execution state machines from system logs and generation of synthetic relational data for anomaly detection. The work treats logs not as flat sequences but as traces constrained by hidden protocol structure, using state machine reconstruction to enforce relational coherence during training data synthesis.

What I took from it

The paper addresses a genuine gap in how anomaly detection treats protocolized systems: most approaches flatten event sequences, discarding the relational and state-transition structure that defines valid behavior. By recovering state machines directly from logs, the framework makes explicit what should and shouldn't co-occur—essentially reverse-engineering the protocol grammar from observed behavior.

This is operationally useful but theoretically incremental. The core insight—that protocol structure constrains which event combinations are anomalous—is not new; this is engineering that insight into a data generation pipeline. The contribution is in mechanism (how to discover and apply state machines to synthetic data generation) rather than in identifying a new law about how constrained systems behave. The work assumes the state machine exists and is recoverable; it doesn't challenge or extend our understanding of why protocols enforce such structures, or what happens when they break.

Research connections

• None yet identified against established laws or active hypotheses in new nature inventory.

Candidate laws or signals

none