Explainable Network Flow and System Log Anomaly Detection for Enterprise Computing Security

Enterprise computing failures and cyber intrusions can share symptoms without sharing causes. This study evaluates independent network-flow and system-log anomaly classifiers and proposes a provenance-aware multimodal architecture. The NF-UNSW-NB15 v1 experiment compares class-balanced logistic regression with a 90-tree random forest using 120,000 training records and 40,000 disjoint test records sampled after stratified partitioning. The random forest achieved 98.525% accuracy, 76.40% precision, 96.32% recall, 85.21% F1, 0.9977 ROC-AUC, and 0.9466 average precision. Logistic regression achieved 60.595% accuracy and 16.64% F1. A separate BGL analysis characterizes 4,747,963 log records and evaluates a text classifier on a 2,000-message structured sample. The BGL classifier achieved F1 of 0.988 on a stratified record holdout and 0.937 on an unseen-template holdout. These results establish source-specific retrospective classification performance. The datasets lack shared asset identifiers and verified incident timelines; therefore, the study does not establish hardware-to-attack causality, prospective hardware-failure prediction, production generalization, or a measured multimodal fusion benefit. The proposed architecture specifies the data alignment, explanatory safeguards, and prospective validation needed before integrated deployment.