Modern operating systems generate massive volumes of complex log data, making it challenging to promptly detect malicious activities and system anomalies. Traditional security systems are primarily designed to counter high-volume attacks but often fail to identify low-rate threats that blend into normal traffic patterns. Existing anomaly detection methods typically rely on feature-based models and struggle to capture the underlying behavioral patterns reflected in logs. To address this gap, we propose a behavior-based anomaly detection system that leverages log sequence analysis. By transforming log entries into unique log sequences and modeling normal system behavior, the system can identify subtle deviations indicative of malicious activity. Experimental results demonstrate that the proposed approach enables accurate, real-time detection.