用大模型分析异构日志，提升网络安全检测准确率。
Next-generation cyberattack detection with large language models: anomaly analysis across heterogeneous logs
- 构建两个带攻击标注的隐私保护日志数据集，解决数据稀缺问题。
- 实测单会话检测耗时0.3-0.5秒，日均成本低于50美元。
- 提出两阶段训练框架，兼顾理解能力与实时性，适合安全团队落地。
本项目探索大型语言模型（LLMs）在异构日志中的异常检测应用。传统入侵检测系统存在误报率高、语义盲区及数据稀缺等问题，因日志本身敏感，干净数据集稀有。我们通过三项贡献应对挑战：(1) 构建 LogAtlas-Foundation-Sessions 和 LogAtlas-Defense-Set 两个平衡且异构的日志数据集，具备明确攻击标注并实现隐私保护；(2) 实证基准测试揭示标准指标如F1和准确率在安全场景中具有误导性；(3) 提出两阶段训练框架，结合具备日志理解能力的 Base-AMAN（3B参数）与实时检测模块 AMAN（0.5B参数，通过知识蒸馏获得）。结果表明该方案具备实际可行性，单会话推理时间仅为0.3–0.5秒，运营成本低于每日50美元。
原文摘要 · Abstract (English)
This project explores large language models (LLMs) for anomaly detection across heterogeneous log sources. Traditional intrusion detection systems suffer from high false positive rates, semantic blindness, and data scarcity, as logs are inherently sensitive, making clean datasets rare. We address these challenges through three contributions: (1) LogAtlas-Foundation-Sessions and LogAtlas-Defense-Set, balanced and heterogeneous log datasets with explicit attack annotations and privacy preservation; (2) empirical benchmarking revealing why standard metrics such as F1 and accuracy are misleading for security applications; and (3) a two phase training framework combining log understanding (Base-AMAN, 3B parameters) with real time detection (AMAN, 0.5B parameters via knowledge distillation). Results demonstrate practical feasibility, with inference times of 0.3-0.5 seconds per session and operational costs below 50 USD per day.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。