Converting each log of a sequence of N logs into an identifier among K different identifiers to obtain a sequence of N identifiers;



for each n between 0 and N:

for each K identifier: counting occurrences of the identifier among the first n identifiers of the sequence to obtain a front frequency of the identifier for the respective n; and
for each K identifier: counting occurrences of the identifier among the last N−n identifiers of the sequence to obtain a rear frequency of the identifier for the respective n;
arranging front frequencies and rear frequencies in a count vector;
inputting the count vector an autoencoder to obtain an output vector for the respective n;
determining a difference between the output vector and the count vector;
marking the sequence as anomalous if the difference between the output vector and the count vector is larger than a threshold.