将日志转为自然语言，提升安全分析可读性与效率
NLLog: Lightweight, Explainable SOC Anomaly Detection via Log-to-Language Rewriting
- 用确定性规则把日志模板转为谁做了什么及严重性句子
- 在HDFS、BGL等数据集上误报率低，单机硬件延迟可满足安全中心需求
- 可追溯分析证据，适合需要解释性的安全运营场景
系统生成的日志虽支撑安全监控，但其固定模板格式阻碍了自动化分析与人工理解。我们提出NLLog（自然语言日志），一种轻量级管道：将解析后的日志模板确定性重写为‘谁-做了什么-严重性’句式，采用TF-IDF加权聚合，用树模型分类会话，并通过TreeSHAP回溯证据供分析师审查。在Hadoop分布式文件系统（HDFS）和蓝基因/L（BGL）数据集上，NLLog优于两种复现的匹配协议基线；在HDFS、BGL及AIT警报数据集上，均保持低误报率，且单机硬件延迟适用于安全运营中心的初步排查。覆盖度、稀疏与稠密对比、忠实性及对抗性消融实验表明：降级可用性依赖数据集，部署前的覆盖率检查可提前暴露优化需求，而可审计的确定性重写结合轻量稠密编码，为日志异常检测与排查提供了可度量的表征层。
原文摘要 · Abstract (English)
System-generated logs underpin security monitoring, yet their rigid template-based format hinders both automated analysis and human comprehension. We present NLLog (Natural-Language Log), a lightweight pipeline that deterministically rewrites parsed templates into WHO-WHAT-SEVERITY sentences, pools them with term-frequency-inverse-document-frequency weighting, classifies sessions with tree ensembles, and back-projects evidence with TreeSHAP for analyst review. On Hadoop Distributed File System (HDFS) and Blue Gene/L (BGL) corpora, NLLog exceeds two reproduced matched-protocol baselines; across HDFS, BGL, and the AIT Alert Data Set, it sustains low false-positive rates with commodity-hardware latency suitable for security operations center triage. Coverage, sparse-versus-dense, faithfulness, and adversarial ablations show that fallback sufficiency is corpus-dependent, that an enrollment-time coverage check can surface refinement requirements before deployment, and that an auditable deterministic rewrite combined with lightweight dense encoding provides a measurable representation layer for log-anomaly detection and triage.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。