Parser-Free Querying of Security Logs

• URL: http://arxiv.org/abs/2605.22027v1
• Date: Thu, 21 May 2026 05:58:04 GMT
• Title: Parser-Free Querying of Security Logs
• Abstract summary: Security analysts routinely query system logs to detect threats and investigate incidents.<n>Each log source uses its own semi-structured format: logs are cheap to produce, but expensive to use.<n>We present Sieve, a system that generates executable query code from natural-language security questions.
• Score: 2.9970870516340504
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Security analysts routinely query system logs to detect threats and investigate incidents, but each log source uses its own semi-structured format: logs are cheap to produce, but expensive to use. The standard approach, building per-source parsers to normalize logs into structured schemas, is powerful but requires continuous engineering effort for each new format. Querying raw logs directly with tools like grep avoids this cost, but requires analysts to know each source's message variants and cannot express the multi-line temporal queries that security investigations demand. We present Sieve, a system that generates executable query code from natural-language security questions by grounding a large language model with lightweight, automatically extracted log-format context, requiring only one LLM call per query followed by deterministic execution. Evaluating 133 security queries across 5 log types, we find that Sieve achieves over a 3x reduction in error rate on complex temporal and cross-event queries compared to manual analyst scripting, with the largest gains on the multi-line correlation tasks most critical to active investigations. Our results and benchmark provide evidence that LLM-generated code can bridge the gap between the expressiveness of structured log querying and the immediacy of working directly with raw files.

Related papers

• TELLER: Non-intrusive Cross-Layer Root-Cause Analysis for LLM Inference [47.62941623025392]
  We present TELLER, a non-intrusive and Log-aware LLM inference Root-cause analysis framework.<n>TELLER collects NVTX/CUPTI traces and service logs without modifying model binaries.<n>It reconstructs per-request call-chain trees and aligns log lines with corresponding execution steps.<n>On top of these representations, TELLER combines numeric candidate localization with a multimodal root-cause model.
  arXiv  Detail & Related papers  (2026-08-03T09:39:11Z)
• LogNLQ: Natural-Language Log Querying with Parser-Induced and Semantically Grounded Schemas [40.92526942288794]
  We present LogNLQ, a framework that formulates natural-language querying over log-induced and semantically grounded schemas.<n>LogNLQ parses raw logs into template-ed relational tables, then applies dual-granularity semantic grounding to annotate both templates and parameter columns.<n>At query time, relevant schema candidates are retrieved via semantic search, and a large language model generates executablesql.
  arXiv  Detail & Related papers  (2026-07-04T14:02:06Z)
• LogCopilot: Automating Log Aggregation Analysis through Large Language Models [10.856198031410353]
  This paper proposes LogCopilot, an automated log aggregation analysis framework based on large language models (LLMs)<n>LogCopilot accepts natural language log analysis instructions and accomplishes automated log analysis through knowledge retrieval and tool calling.<n>It achieves automated log aggregation analysis by generating and executing LogQL queries.
  arXiv  Detail & Related papers  (2026-06-13T15:47:53Z)
• Towards Agentic Investigation of Security Alerts [0.07646713951724012]
  Security analysts are overwhelmed by the volume of alerts and the low context provided by detection systems.<n>Early-stage investigations typically require manual correlation across multiple log sources.<n>We present an experimental, agentic workflow that leverages large language models (LLMs) augmented with predefined queries.
  arXiv  Detail & Related papers  (2026-04-28T16:52:12Z)
• OrLog: Resolving Complex Queries with LLMs and Probabilistic Reasoning [51.58235452818926]
  We introduce OrLog, a neuro-symbolic retrieval framework that decouples predicate-level plausibility estimation from logical reasoning.<n>A large language model (LLM) provides plausibility scores for atomic predicates in one decoding-free forward pass, from which a probabilistic reasoning engine derives the posterior probability of query satisfaction.
  arXiv  Detail & Related papers  (2026-01-30T15:31:58Z)
• Beyond Isolated Dots: Benchmarking Structured Table Construction as Deep Knowledge Extraction [80.88654868264645]
  Arranged and Organized Extraction Benchmark designed to evaluate ability of large language models to comprehend fragmented documents.<n>AOE includes 11 carefully crafted tasks across three diverse domains, requiring models to generate context-specific schema tailored to varied input queries.<n>Results show that even the most advanced models struggled significantly.
  arXiv  Detail & Related papers  (2025-07-22T06:37:51Z)
• Semantic-Aware Parsing for Security Logs [12.498937359368309]
  Existing AI-baseds focus on learning syntactic log templates but lack the semantic interpretation needed for querying.<n>Matryoshka is the first end-to-end system leveraging LLMs to automatically generate semantically-aware structured logs.<n>Matryoshka significantly reduces manual effort by automatically extracting and organizing valuable fields.
  arXiv  Detail & Related papers  (2025-06-20T23:24:09Z)
• HELP: Hierarchical Embeddings-based Log Parsing [0.25112747242081457]
  Logs are a first-hand source of information for software maintenance and failure diagnosis. Log parsing is a prerequisite for automated log analysis tasks such as anomaly detection, troubleshooting, and root cause analysis. Existing online parsing algorithms are susceptible to log drift, where slight log changes create false positives that drown out real anomalies.
  arXiv  Detail & Related papers  (2024-08-15T17:54:31Z)
• Stronger, Cheaper and Demonstration-Free Log Parsing with LLMs [18.240096266464544]
  We propose LogBatcher, a cost-effective LLM-based log that requires no training process or labeled data. We have conducted experiments on 16 public log datasets and the results show that LogBatcher is effective for log parsing.
  arXiv  Detail & Related papers  (2024-06-10T10:39:28Z)
• Log Parsing Evaluation in the Era of Modern Software Systems [47.370291246632114]
  We focus on one integral part of automated log analysis, log parsing, which is the prerequisite to deriving any insights from logs. Our investigation reveals problematic aspects within the log parsing field, particularly its inefficiency in handling heterogeneous real-world logs. We propose a tool, Logchimera, that enables estimating log parsing performance in industry contexts.
  arXiv  Detail & Related papers  (2023-08-17T14:19:22Z)
• Autoregressive Search Engines: Generating Substrings as Document Identifiers [53.0729058170278]
  Autoregressive language models are emerging as the de-facto standard for generating answers. Previous work has explored ways to partition the search space into hierarchical structures. In this work we propose an alternative that doesn't force any structure in the search space: using all ngrams in a passage as its possible identifiers.
  arXiv  Detail & Related papers  (2022-04-22T10:45:01Z)
• Text Summarization with Latent Queries [60.468323530248945]
  We introduce LaQSum, the first unified text summarization system that learns Latent Queries from documents for abstractive summarization with any existing query forms. Under a deep generative framework, our system jointly optimize a latent query model and a conditional language model, allowing users to plug-and-play queries of any type at test time. Our system robustly outperforms strong comparison systems across summarization benchmarks with different query types, document settings, and target domains.
  arXiv  Detail & Related papers  (2021-05-31T21:14:58Z)
• Self-Supervised Log Parsing [59.04636530383049]
  Large-scale software systems generate massive volumes of semi-structured log records. Existing approaches rely on log-specifics or manual rule extraction. We propose NuLog that utilizes a self-supervised learning model and formulates the parsing task as masked language modeling.
  arXiv  Detail & Related papers  (2020-03-17T19:25:25Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.