Semantic-Aware Parsing for Security Logs

• URL: http://arxiv.org/abs/2506.17512v1
• Date: Fri, 20 Jun 2025 23:24:09 GMT
• Title: Semantic-Aware Parsing for Security Logs
• Abstract summary: Existing AI-baseds focus on learning syntactic log templates but lack the semantic interpretation needed for querying.<n>Matryoshka is the first end-to-end system leveraging LLMs to automatically generate semantically-aware structured logs.<n>Matryoshka significantly reduces manual effort by automatically extracting and organizing valuable fields.
• Score: 12.498937359368309
• License: http://creativecommons.org/licenses/by-sa/4.0/
• Abstract: Security analysts struggle to quickly and efficiently query and correlate log data due to the heterogeneity and lack of structure in real-world logs. Existing AI-based parsers focus on learning syntactic log templates but lack the semantic interpretation needed for querying. Directly querying large language models on raw logs is impractical at scale and vulnerable to prompt injection attacks. In this paper, we introduce Matryoshka, the first end-to-end system leveraging LLMs to automatically generate semantically-aware structured log parsers. Matryoshka combines a novel syntactic parser-employing precise regular expressions rather than wildcards-with a completely new semantic parsing layer that clusters variables and maps them into a queryable, contextually meaningful schema. This approach provides analysts with queryable and semantically rich data representations, facilitating rapid and precise log querying without the traditional burden of manual parser construction. Additionally, Matryoshka can map the newly created fields to recognized attributes within the Open Cybersecurity Schema Framework (OCSF), enabling interoperability. We evaluate Matryoshka on a newly curated real-world log benchmark, introducing novel metrics to assess how consistently fields are named and mapped across logs. Matryoshka's syntactic parser outperforms prior works, and the semantic layer achieves an F1 score of 0.95 on realistic security queries. Although mapping fields to the extensive OCSF taxonomy remains challenging, Matryoshka significantly reduces manual effort by automatically extracting and organizing valuable fields, moving us closer to fully automated, AI-driven log analytics.

Related papers

• LogNLQ: Natural-Language Log Querying with Parser-Induced and Semantically Grounded Schemas [40.92526942288794]
  We present LogNLQ, a framework that formulates natural-language querying over log-induced and semantically grounded schemas.<n>LogNLQ parses raw logs into template-ed relational tables, then applies dual-granularity semantic grounding to annotate both templates and parameter columns.<n>At query time, relevant schema candidates are retrieved via semantic search, and a large language model generates executablesql.
  arXiv  Detail & Related papers  (2026-07-04T14:02:06Z)
• Parser-Free Querying of Security Logs [2.9970870516340504]
  Security analysts routinely query system logs to detect threats and investigate incidents.<n>Each log source uses its own semi-structured format: logs are cheap to produce, but expensive to use.<n>We present Sieve, a system that generates executable query code from natural-language security questions.
  arXiv  Detail & Related papers  (2026-05-21T05:58:04Z)
• SCOPE: Tree-based Self-Correcting Online Log Parsing via Syntactic-Semantic Collaboration [3.338964978828878]
  SCOPE is the first self-correcting online log parsing method.<n>It integrates the strengths of both and LLM-based paradigms.<n>It outperforms state-of-the-art methods in both accuracy and efficiency.
  arXiv  Detail & Related papers  (2026-03-28T11:45:08Z)
• Performance Evaluation of LLMs in Automated RDF Knowledge Graph Generation [0.0]
  Large Language Models (LLMs) offer a promising approach to automate RDF knowledge graph generation.<n>We evaluate multiple LLMs and prompting strategies for automated RDF extraction using a controlled framework.<n>Our analysis shows that Few-Shot learning is the most effective strategy, with Llama achieving a 99.35% F1 score and 100% valid RDF output.
  arXiv  Detail & Related papers  (2026-02-06T06:30:35Z)
• OrLog: Resolving Complex Queries with LLMs and Probabilistic Reasoning [51.58235452818926]
  We introduce OrLog, a neuro-symbolic retrieval framework that decouples predicate-level plausibility estimation from logical reasoning.<n>A large language model (LLM) provides plausibility scores for atomic predicates in one decoding-free forward pass, from which a probabilistic reasoning engine derives the posterior probability of query satisfaction.
  arXiv  Detail & Related papers  (2026-01-30T15:31:58Z)
• MicLog: Towards Accurate and Efficient LLM-based Log Parsing via Progressive Meta In-Context Learning [26.849902115105255]
  Recent large language model (LLM)-baseds leverage in-context learning (ICL) to extract semantics from examples, demonstrating superior accuracy.<n>We present MicLog, the first progressive meta in-consuming learning (ProgMeta-ICL) log parsing framework that combines meta-learning with ICL on small open-source LLMs.<n>MicLog achieves 10.3% higher parsing accuracy than the state-of-the-art, while reducing parsing time by 42.4%.
  arXiv  Detail & Related papers  (2026-01-11T17:46:10Z)
• Optimized Log Parsing with Syntactic Modifications [2.2917707112773593]
  We compare syntax- and semantic-based log parsing architectures.<n>We propose SynLog+, a template identification module that acts as the second phase in a two-phase log parsing architecture.
  arXiv  Detail & Related papers  (2025-10-30T17:59:22Z)
• Question-Driven Analysis and Synthesis: Building Interpretable Thematic Trees with LLMs for Text Clustering and Controllable Generation [1.3750624267664158]
  We introduce Recursive Thematic Partitioning (RTP) to interactively build a binary tree.<n>Each node in the tree is a natural language question that semantically partitions the data, resulting in a fully interpretable taxonomy.<n>We show that RTP's question-driven hierarchy is more interpretable than the keyword-based topics from a strong baseline like BERTopic.
  arXiv  Detail & Related papers  (2025-09-26T11:27:22Z)
• System Log Parsing with Large Language Models: A Review [2.2779174914142346]
  Large language models (LLMs) have introduced the new research field of LLM-based log parsing.<n>Despite promising results, there is no structured overview of the approaches in this relatively new research field.<n>This work systematically reviews 29 LLM-based log parsing methods.
  arXiv  Detail & Related papers  (2025-04-07T09:41:04Z)
• Localizing Factual Inconsistencies in Attributable Text Generation [91.981439746404]
  We introduce QASemConsistency, a new formalism for localizing factual inconsistencies in attributable text generation. We first demonstrate the effectiveness of the QASemConsistency methodology for human annotation. We then implement several methods for automatically detecting localized factual inconsistencies.
  arXiv  Detail & Related papers  (2024-10-09T22:53:48Z)
• LogParser-LLM: Advancing Efficient Log Parsing with Large Language Models [19.657278472819588]
  We introduce Log-LLM, a novel log integrated with LLM capabilities. We address the intricate challenge of parsing granularity, proposing a new metric to allow users to calibrate granularity to their specific needs. Our method's efficacy is empirically demonstrated through evaluations on the Loghub-2k and the large-scale LogPub benchmark.
  arXiv  Detail & Related papers  (2024-08-25T05:34:24Z)
• HELP: Hierarchical Embeddings-based Log Parsing [0.25112747242081457]
  Logs are a first-hand source of information for software maintenance and failure diagnosis. Log parsing is a prerequisite for automated log analysis tasks such as anomaly detection, troubleshooting, and root cause analysis. Existing online parsing algorithms are susceptible to log drift, where slight log changes create false positives that drown out real anomalies.
  arXiv  Detail & Related papers  (2024-08-15T17:54:31Z)
• Lemur: Log Parsing with Entropy Sampling and Chain-of-Thought Merging [18.823038918091207]
  We introduce a cutting-edge texttextbfLog parsing framework with textbfEntropy sampling and chain-of-thought textbfMerging (model)<n>To discard the tedious manual rules, we propose a novel sampling method inspired by information entropy, which efficiently clusters typical logs.<n>We have conducted experiments on large-scale public datasets.
  arXiv  Detail & Related papers  (2024-02-28T09:51:55Z)
• LILAC: Log Parsing using LLMs with Adaptive Parsing Cache [38.04960745458878]
  We propose LILAC, the first practical log parsing framework using large language models (LLMs) with adaptive parsing cache. LLMs's lack of specialized log parsing capabilities currently hinders their accuracy in parsing. We show LILAC outperforms state-of-the-art methods by 69.5% in terms of the average F1 score of template accuracy.
  arXiv  Detail & Related papers  (2023-10-03T04:46:59Z)
• Guiding the PLMs with Semantic Anchors as Intermediate Supervision: Towards Interpretable Semantic Parsing [57.11806632758607]
  We propose to incorporate the current pretrained language models with a hierarchical decoder network. By taking the first-principle structures as the semantic anchors, we propose two novel intermediate supervision tasks. We conduct intensive experiments on several semantic parsing benchmarks and demonstrate that our approach can consistently outperform the baselines.
  arXiv  Detail & Related papers  (2022-10-04T07:27:29Z)
• Improving Text-to-SQL Semantic Parsing with Fine-grained Query Understanding [84.04706075621013]
  We present a general-purpose, modular neural semantic parsing framework based on token-level fine-grained query understanding. Our framework consists of three modules: named entity recognizer (NER), neural entity linker (NEL) and neural entity linker (NSP)
  arXiv  Detail & Related papers  (2022-09-28T21:00:30Z)
• Autoregressive Search Engines: Generating Substrings as Document Identifiers [53.0729058170278]
  Autoregressive language models are emerging as the de-facto standard for generating answers. Previous work has explored ways to partition the search space into hierarchical structures. In this work we propose an alternative that doesn't force any structure in the search space: using all ngrams in a passage as its possible identifiers.
  arXiv  Detail & Related papers  (2022-04-22T10:45:01Z)
• Low-Resource Task-Oriented Semantic Parsing via Intrinsic Modeling [65.51280121472146]
  We exploit what we intrinsically know about ontology labels to build efficient semantic parsing models. Our model is highly efficient using a low-resource benchmark derived from TOPv2.
  arXiv  Detail & Related papers  (2021-04-15T04:01:02Z)
• Self-Supervised Log Parsing [59.04636530383049]
  Large-scale software systems generate massive volumes of semi-structured log records. Existing approaches rely on log-specifics or manual rule extraction. We propose NuLog that utilizes a self-supervised learning model and formulates the parsing task as masked language modeling.
  arXiv  Detail & Related papers  (2020-03-17T19:25:25Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.