BlackStork AnoMark uses machine learning and natural language processing to analyze command lines from event logs, employing n-grams and a Markov chain model to detect anomalies. It calculates likelihood scores for new command lines and identifies abnormal patterns to detect malicious behavior. The tool is open-source and can be integrated into modern Security Information and Event Management systems, with a provided Splunk implementation example.
