CAM-LDS: Cyber Attack Manifestations for Automatic Interpretation of System Logs and Security Alerts

• URL: http://arxiv.org/abs/2603.04186v1
• Date: Wed, 04 Mar 2026 15:38:21 GMT
• Title: CAM-LDS: Cyber Attack Manifestations for Automatic Interpretation of System Logs and Security Alerts
• Abstract summary: We introduce the Cyber Attack Log Data Set (CAM-LDS), comprising seven attack scenarios and collected from 18 distinct sources within a fully open-source and reproducible test environment.<n>We extract log events that directly result from attack executions to facilitate analysis of manifestations concerning command observability event, performance metrics, and intrusion detection alerts.<n>The results indicate that correct attack techniques are predicted perfectly for approximately one third of attack steps adequately for another third.
• Score: 2.882241577423132
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: Log data are essential for intrusion detection and forensic investigations. However, manual log analysis is tedious due to high data volumes, heterogeneous event formats, and unstructured messages. Even though many automated methods for log analysis exist, they usually still rely on domain-specific configurations such as expert-defined detection rules, handcrafted log parsers, or manual feature-engineering. Crucially, the level of automation of conventional methods is limited due to their inability to semantically understand logs and explain their underlying causes. In contrast, Large Language Models enable domain- and format-agnostic interpretation of system logs and security alerts. Unfortunately, research on this topic remains challenging, because publicly available and labeled data sets covering a broad range of attack techniques are scarce. To address this gap, we introduce the Cyber Attack Manifestation Log Data Set (CAM-LDS), comprising seven attack scenarios that cover 81 distinct techniques across 13 tactics and collected from 18 distinct sources within a fully open-source and reproducible test environment. We extract log events that directly result from attack executions to facilitate analysis of manifestations concerning command observability, event frequencies, performance metrics, and intrusion detection alerts. We further present an illustrative case study utilizing an LLM to process the CAM-LDS. The results indicate that correct attack techniques are predicted perfectly for approximately one third of attack steps and adequately for another third, highlighting the potential of LLM-based log interpretation and utility of our data set.

Related papers

• Just Testing, Move Along: Evasion of LLM-based System Log Interpretation by Prompt Injection [2.900900313242943]
  This paper presents a framework for evaluating prompt injection attacks against large language models (LLMs) based on system logs.<n>Using log traces generated during real cyber attacks, our approach creates adversarial examples through generic injection generation, refinement, and attack-specific optimization.<n>Our evaluation shows that these injections can cause malicious log traces to be classified as benign despite containing clear indicators of compromise.
  arXiv  Detail & Related papers  (2026-07-27T08:59:00Z)
• Logic-Driven Cybersecurity: A Novel Framework for System Log Anomaly Detection using Answer Set Programming [5.201769379977414]
  This study explores the application of Answer Set Programming (ASP) for detecting anomalies in system logs.<n>We propose a novel framework that leverages ASP's declarative nature and logical reasoning capabilities to encode complex security rules as logical predicates.
  arXiv  Detail & Related papers  (2025-12-04T15:37:32Z)
• Searching for Privacy Risks in LLM Agents via Simulation [61.229785851581504]
  We present a search-based framework that alternates between improving attack and defense strategies through the simulation of privacy-critical agent interactions.<n>We find that attack strategies escalate from direct requests to sophisticated tactics, such as impersonation and consent forgery.<n>The discovered attacks and defenses transfer across diverse scenarios and backbone models, demonstrating strong practical utility for building privacy-aware agents.
  arXiv  Detail & Related papers  (2025-08-14T17:49:09Z)
• From Alerts to Intelligence: A Novel LLM-Aided Framework for Host-based Intrusion Detection [16.59938864299474]
  Large Language Models (LLMs) have great potentials to advance the state of host-based intrusion detection system (HIDS)<n>LLMs have extensive knowledge of attack techniques and their ability to detect anomalies through semantic analysis.<n>In this work, we explore the direction of building a customized LLM pipeline for HIDS and develop a system named SHIELD.
  arXiv  Detail & Related papers  (2025-07-15T00:24:53Z)
• SmartGuard: Leveraging Large Language Models for Network Attack Detection through Audit Log Analysis and Summarization [29.04306601920854]
  End-point monitoring solutions are widely deployed in today's enterprise environments to support advanced attack detection and investigation.<n>Existing methods of semantic analysis based on audit logs have low granularity, only reaching the system call level.<n>We propose SmartGuard, an automated method that combines abstracted behaviors from audit event semantics with large language models.
  arXiv  Detail & Related papers  (2025-06-20T13:19:17Z)
• EXPLICATE: Enhancing Phishing Detection through Explainable AI and LLM-Powered Interpretability [44.2907457629342]
  EXPLICATE is a framework that enhances phishing detection through a three-component architecture.<n>It is on par with existing deep learning techniques but has better explainability.<n>It addresses the critical divide between automated AI and user trust in phishing detection systems.
  arXiv  Detail & Related papers  (2025-03-22T23:37:35Z)
• FATH: Authentication-based Test-time Defense against Indirect Prompt Injection Attacks [45.65210717380502]
  Large language models (LLMs) have been widely deployed as the backbone with additional tools and text information for real-world applications. prompt injection attacks are particularly threatening, where malicious instructions injected in the external text information can exploit LLMs to generate answers as the attackers desire. This paper introduces a novel test-time defense strategy, named AuThentication with Hash-based tags (FATH)
  arXiv  Detail & Related papers  (2024-10-28T20:02:47Z)
• Using Large Language Models for Template Detection from Security Event Logs [0.9217021281095907]
  Event log analysis techniques are essential for the timely detection of cyber attacks and for assisting security experts with the analysis of past security incidents.<n>The detection of line patterns or templates from unstructured textual event logs has been identified as an important task of event log analysis.<n>This paper investigates the application of Large Language Models (LLMs) for unsupervised detection of templates from unstructured security event logs.
  arXiv  Detail & Related papers  (2024-09-08T10:06:54Z)
• LogFormer: A Pre-train and Tuning Pipeline for Log Anomaly Detection [73.69399219776315]
  We propose a unified Transformer-based framework for Log anomaly detection (LogFormer) to improve the generalization ability across different domains. Specifically, our model is first pre-trained on the source domain to obtain shared semantic knowledge of log data. Then, we transfer such knowledge to the target domain via shared parameters.
  arXiv  Detail & Related papers  (2024-01-09T12:55:21Z)
• The Adversarial Implications of Variable-Time Inference [47.44631666803983]
  We present an approach that exploits a novel side channel in which the adversary simply measures the execution time of the algorithm used to post-process the predictions of the ML model under attack. We investigate leakage from the non-maximum suppression (NMS) algorithm, which plays a crucial role in the operation of object detectors. We demonstrate attacks against the YOLOv3 detector, leveraging the timing leakage to successfully evade object detection using adversarial examples, and perform dataset inference.
  arXiv  Detail & Related papers  (2023-09-05T11:53:17Z)
• LogPrécis: Unleashing Language Models for Automated Malicious Log Analysis [4.380767833087969]
  We show how to benefit from the state-of-the-art in Language Models to automatically analyze text-like Unix shell attack logs. We demonstrate LogPr'ecis capability to support the analysis of two large datasets containing about 400,000 unique Unix shell attacks.
  arXiv  Detail & Related papers  (2023-07-17T08:09:40Z)
• LogLAB: Attention-Based Labeling of Log Data Anomalies via Weak Supervision [63.08516384181491]
  We present LogLAB, a novel modeling approach for automated labeling of log messages without requiring manual work by experts. Our method relies on estimated failure time windows provided by monitoring systems to produce precise labeled datasets in retrospect. Our evaluation shows that LogLAB consistently outperforms nine benchmark approaches across three different datasets and maintains an F1-score of more than 0.98 even at large failure time windows.
  arXiv  Detail & Related papers  (2021-11-02T15:16:08Z)
• Robust and Transferable Anomaly Detection in Log Data using Pre-Trained Language Models [59.04636530383049]
  Anomalies or failures in large computer systems, such as the cloud, have an impact on a large number of users. We propose a framework for anomaly detection in log data, as a major troubleshooting source of system information.
  arXiv  Detail & Related papers  (2021-02-23T09:17:05Z)
• Self-Supervised Log Parsing [59.04636530383049]
  Large-scale software systems generate massive volumes of semi-structured log records. Existing approaches rely on log-specifics or manual rule extraction. We propose NuLog that utilizes a self-supervised learning model and formulates the parsing task as masked language modeling.
  arXiv  Detail & Related papers  (2020-03-17T19:25:25Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.