AI Enhanced Anomaly Detection of System Logs in Cybersecurity

System logs contain valuable information about authentication attempts, application events, operating system activities, and potential cybersecurity threats. However, manually analysing large volumes of log data is time-consuming and may delay the detection of suspicious activities. This paper presents an Artificial Intelligence (AI)-enhanced system for detecting anomalous patterns in system logs using machine learning techniques. The proposed workflow includes log collection, preprocessing, time-window aggregation, feature extraction, anomaly scoring, threshold-based classification, and security alert generation. Isolation Forest is used as the primary unsupervised anomaly detection algorithm and is compared with Local Outlier Factor (LOF), One-Class Support Vector Machine (SVM), Principal Component Analysis (PCA), and a Multilayer Perceptron (MLP) autoencoder. The evaluation uses a simulated dataset containing 30,000 one-hour activity windows, including 1,050 injected anomaly windows. The reported results show that Isolation Forest achieves a precision of 0.594, recall of 0.553, F1-score of 0.573, ROC-AUC of 0.962, and average precision of 0.613. Although Isolation Forest provides a lightweight detection approach, the comparison indicates that other methods achieve higher F1-scores under the reported experimental conditions. The findings highlight the importance of threshold selection, class imbalance, and multiple evaluation metrics in anomaly detection. The proposed workflow provides a foundation for cybersecurity monitoring and suspicious-activity prioritisation. Further validation using real-world enterprise logs is required to establish its effectiveness in practical deployment.