LogPrécis: Unleashing Language Models for Automated Malicious Log Analysis

• URL: http://arxiv.org/abs/2307.08309v3
• Date: Fri, 22 Mar 2024 15:52:47 GMT
• Title: LogPrécis: Unleashing Language Models for Automated Malicious Log Analysis
• Abstract summary: We show how to benefit from the state-of-the-art in Language Models to automatically analyze text-like Unix shell attack logs. We demonstrate LogPr'ecis capability to support the analysis of two large datasets containing about 400,000 unique Unix shell attacks.
• Score: 4.380767833087969
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: The collection of security-related logs holds the key to understanding attack behaviors and diagnosing vulnerabilities. Still, their analysis remains a daunting challenge. Recently, Language Models (LMs) have demonstrated unmatched potential in understanding natural and programming languages. The question arises whether and how LMs could be also useful for security experts since their logs contain intrinsically confused and obfuscated information. In this paper, we systematically study how to benefit from the state-of-the-art in LM to automatically analyze text-like Unix shell attack logs. We present a thorough design methodology that leads to LogPr\'ecis. It receives as input raw shell sessions and automatically identifies and assigns the attacker tactic to each portion of the session, i.e., unveiling the sequence of the attacker's goals. We demonstrate LogPr\'ecis capability to support the analysis of two large datasets containing about 400,000 unique Unix shell attacks. LogPr\'ecis reduces them into about 3,000 fingerprints, each grouping sessions with the same sequence of tactics. The abstraction it provides lets the analyst better understand attacks, identify fingerprints, detect novelty, link similar attacks, and track families and mutations. Overall, LogPr\'ecis, released as open source, paves the way for better and more responsive defense against cyberattacks.

Related papers

• Just Testing, Move Along: Evasion of LLM-based System Log Interpretation by Prompt Injection [2.900900313242943]
  This paper presents a framework for evaluating prompt injection attacks against large language models (LLMs) based on system logs.<n>Using log traces generated during real cyber attacks, our approach creates adversarial examples through generic injection generation, refinement, and attack-specific optimization.<n>Our evaluation shows that these injections can cause malicious log traces to be classified as benign despite containing clear indicators of compromise.
  arXiv  Detail & Related papers  (2026-07-27T08:59:00Z)
• Analyzing Defensive Misdirection Against Model-Guided Automated Attacks on Agentic AI Systems [0.0]
  Agentic AI systems increasingly rely on language-model components to interpret instructions, process external data, invoke tools, and coordinate with other agents.<n>This work analyzes the resulting attack-defense setting through a probabilistic model of a target system, its defense mechanism, and the attacker's automated judge.
  arXiv  Detail & Related papers  (2026-06-18T16:50:28Z)
• QUACK! Making the (Rubber) Ducky Talk: A Systematic Study of Keystroke Dynamics for HID Injection Detection [60.105690843777666]
  We show that robust, privacy-preserving detection is achievable using lightweight models operating solely on timing features.<n>Our analysis reveals that attacker sophistication does not monotonically translate into improved evasion.
  arXiv  Detail & Related papers  (2026-04-17T08:53:24Z)
• CAM-LDS: Cyber Attack Manifestations for Automatic Interpretation of System Logs and Security Alerts [2.882241577423132]
  We introduce the Cyber Attack Log Data Set (CAM-LDS), comprising seven attack scenarios and collected from 18 distinct sources within a fully open-source and reproducible test environment.<n>We extract log events that directly result from attack executions to facilitate analysis of manifestations concerning command observability event, performance metrics, and intrusion detection alerts.<n>The results indicate that correct attack techniques are predicted perfectly for approximately one third of attack steps adequately for another third.
  arXiv  Detail & Related papers  (2026-03-04T15:38:21Z)
• Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systems [7.15710884787427]
  Large language models (LLMs) increasingly rely on retrieving information from external corpora.<n>This creates a new attack surface: indirect prompt injection (IPI)<n>We present the first end-to-end IPI exploits under natural queries and realistic external corpora.
  arXiv  Detail & Related papers  (2026-01-11T21:33:59Z)
• Logic-Driven Cybersecurity: A Novel Framework for System Log Anomaly Detection using Answer Set Programming [5.201769379977414]
  This study explores the application of Answer Set Programming (ASP) for detecting anomalies in system logs.<n>We propose a novel framework that leverages ASP's declarative nature and logical reasoning capabilities to encode complex security rules as logical predicates.
  arXiv  Detail & Related papers  (2025-12-04T15:37:32Z)
• Security Logs to ATT&CK Insights: Leveraging LLMs for High-Level Threat Understanding and Cognitive Trait Inference [1.8135692038751479]
  Real-time defense requires the ability to infer attacker intent and cognitive strategy from intrusion detection system (IDS) logs.<n>We propose a novel framework that leverages large language models (LLMs) to analyze Suricata IDS logs and infer attacker actions.<n>This lays the groundwork for future work on behaviorally adaptive cyber defense and cognitive trait inference.
  arXiv  Detail & Related papers  (2025-10-23T18:43:31Z)
• Privacy-Preserving Anonymization of System and Network Event Logs Using Salt-Based Hashing and Temporal Noise [5.85293491327449]
  Event logs contain Personally Identifiable Information (PII)<n>Overly aggressive anonymization can destroy contextual integrity, while weak techniques risk re-identification through linkage or inference attacks.<n>This paper introduces novel field-specific anonymization methods that address this trade-off.
  arXiv  Detail & Related papers  (2025-07-29T15:16:42Z)
• Semantic-Aware Parsing for Security Logs [12.498937359368309]
  Existing AI-baseds focus on learning syntactic log templates but lack the semantic interpretation needed for querying.<n>Matryoshka is the first end-to-end system leveraging LLMs to automatically generate semantically-aware structured logs.<n>Matryoshka significantly reduces manual effort by automatically extracting and organizing valuable fields.
  arXiv  Detail & Related papers  (2025-06-20T23:24:09Z)
• Client-Side Zero-Shot LLM Inference for Comprehensive In-Browser URL Analysis [0.0]
  Malicious websites and phishing URLs pose an ever-increasing cybersecurity risk.<n>Traditional detection approaches rely on machine learning.<n>We propose a novel client-side framework for comprehensive URL analysis.
  arXiv  Detail & Related papers  (2025-06-04T07:47:23Z)
• Token-Efficient Prompt Injection Attack: Provoking Cessation in LLM Reasoning via Adaptive Token Compression [12.215295420714787]
  "Reasoning Interruption Attack" is a prompt injection attack based on adaptive token compression. We develop a systematic approach to efficiently collect attack prompts and an adaptive token compression framework. Experiments show our compression framework significantly reduces prompt length while maintaining effective attack capabilities.
  arXiv  Detail & Related papers  (2025-04-29T07:34:22Z)
• Unified Semantic Log Parsing and Causal Graph Construction for Attack Attribution [3.9936021096611576]
  Multi-source logs provide a comprehensive overview of ongoing system activities, allowing for in-depth analysis to detect potential threats. A practical approach for threat detection involves explicit extraction of entity triples (subject, action, object) towards building graphs to facilitate the analysis of system behavior. We contribute with a novel unified framework coined UTL, which adopts semantic analysis to construct causal graphs by merging multiple sub-graphs from individual log sources.
  arXiv  Detail & Related papers  (2024-11-22T21:40:19Z)
• FATH: Authentication-based Test-time Defense against Indirect Prompt Injection Attacks [45.65210717380502]
  Large language models (LLMs) have been widely deployed as the backbone with additional tools and text information for real-world applications. prompt injection attacks are particularly threatening, where malicious instructions injected in the external text information can exploit LLMs to generate answers as the attackers desire. This paper introduces a novel test-time defense strategy, named AuThentication with Hash-based tags (FATH)
  arXiv  Detail & Related papers  (2024-10-28T20:02:47Z)
• AutoJailbreak: Exploring Jailbreak Attacks and Defenses through a Dependency Lens [83.08119913279488]
  We present a systematic analysis of the dependency relationships in jailbreak attack and defense techniques. We propose three comprehensive, automated, and logical frameworks. We show that the proposed ensemble jailbreak attack and defense framework significantly outperforms existing research.
  arXiv  Detail & Related papers  (2024-06-06T07:24:41Z)
• Lemur: Log Parsing with Entropy Sampling and Chain-of-Thought Merging [18.823038918091207]
  We introduce a cutting-edge texttextbfLog parsing framework with textbfEntropy sampling and chain-of-thought textbfMerging (model) To discard the tedious manual rules, we propose a novel sampling method inspired by information entropy, which efficiently clusters typical logs. We have conducted experiments on large-scale public datasets.
  arXiv  Detail & Related papers  (2024-02-28T09:51:55Z)
• AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Models [55.748851471119906]
  Safety alignment of Large Language Models (LLMs) can be compromised with manual jailbreak attacks and (automatic) adversarial attacks. Recent studies suggest that defending against these attacks is possible: adversarial attacks generate unlimited but unreadable gibberish prompts, detectable by perplexity-based filters. We introduce AutoDAN, an interpretable, gradient-based adversarial attack that merges the strengths of both attack types.
  arXiv  Detail & Related papers  (2023-10-23T17:46:07Z)
• Attention-Enhancing Backdoor Attacks Against BERT-based Models [54.070555070629105]
  Investigating the strategies of backdoor attacks will help to understand the model's vulnerability. We propose a novel Trojan Attention Loss (TAL) which enhances the Trojan behavior by directly manipulating the attention patterns.
  arXiv  Detail & Related papers  (2023-10-23T01:24:56Z)
• AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models [54.95912006700379]
  We introduce AutoDAN, a novel jailbreak attack against aligned Large Language Models. AutoDAN can automatically generate stealthy jailbreak prompts by the carefully designed hierarchical genetic algorithm.
  arXiv  Detail & Related papers  (2023-10-03T19:44:37Z)
• SEA: Shareable and Explainable Attribution for Query-based Black-box Attacks [28.736776243428654]
  This paper introduces SEA, a novel machine learning security system to characterize black-box attacks on ML systems. We show that SEA is effective at attack attribution, even on their second occurrence. We also demonstrate that SEA can recognize the same attack's second occurrence with 90+% Top-1 and 95+% Top-3 accuracy.
  arXiv  Detail & Related papers  (2023-08-23T00:49:29Z)
• Zero-shot learning approach to adaptive Cybersecurity using Explainable AI [0.5076419064097734]
  We present a novel approach to handle the alarm flooding problem faced by Cybersecurity systems like security information and event management (SIEM) and intrusion detection (IDS) We apply a zero-shot learning method to machine learning (ML) by leveraging explanations for predictions of anomalies generated by a ML model. In this approach, without any prior knowledge of attack, we try to identify it, decipher the features that contribute to classification and try to bucketize the attack in a specific category.
  arXiv  Detail & Related papers  (2021-06-21T06:29:13Z)
• Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger [48.59965356276387]
  We propose to use syntactic structure as the trigger in textual backdoor attacks. We conduct extensive experiments to demonstrate that the trigger-based attack method can achieve comparable attack performance. These results also reveal the significant insidiousness and harmfulness of textual backdoor attacks.
  arXiv  Detail & Related papers  (2021-05-26T08:54:19Z)
• OntoEnricher: A Deep Learning Approach for Ontology Enrichment from Unstructured Text [2.707154152696381]
  Existing information on vulnerabilities, controls, and advisories available on the web provides an opportunity to represent knowledge and perform analytics to mitigate some of the concerns. This necessitates dynamic and automated enrichment of information security. Existing ontology enrichment algorithms based on natural processing and ML models have issues with the contextual extraction of concepts in words, phrases and sentences.
  arXiv  Detail & Related papers  (2021-02-08T09:43:05Z)
• Self-Supervised Log Parsing [59.04636530383049]
  Large-scale software systems generate massive volumes of semi-structured log records. Existing approaches rely on log-specifics or manual rule extraction. We propose NuLog that utilizes a self-supervised learning model and formulates the parsing task as masked language modeling.
  arXiv  Detail & Related papers  (2020-03-17T19:25:25Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.