用少样本让大模型像专家一样分析恶意日志并给出可审计解释
Sample-Efficient LLM-Based Detection of Malicious Web Server Logs with Forensically Explainable Reasoning
- 基于五步推理模板，教会模型如何分析日志而非记忆模式
- 仅用4个样例在CSIC 2010上达F1=0.99，样本效率提升10倍
- 生成可追溯的解释，适合司法取证场景
网络服务器日志的取证分析需要高精度检测与可读性强的解释以满足法律要求。本文提出CEF-Log，一种基于大语言模型的上下文增强少样本思维链提示策略，通过结构化的五步推理模板嵌入专家调查方法，使模型学会如何分析日志而非记忆特定模式。实验表明，CEF-Log在仅使用4个示例的情况下，于CSIC 2010数据集上实现了F1-score为0.99的性能，相比其他提示方法样本效率提升10倍。我们还构建了新数据集ForenWebLog，包含真实攻击和多步骤攻击序列，支持全面评估。定性分析显示，CEF-Log生成的解释具有可追溯性且准确，有效缓解传统机器学习方法的“黑箱”问题。
原文摘要 · Abstract (English)
Forensic analysis of web server logs demands both accurate detection and human-readable explanations that can satisfy legal requirements. We present CEF-Log, a context-enhanced few-shot chain-of-thought prompting strategy for Large Language Models that addresses this dual requirement. CEF-Log embeds expert investigative methodology through a structured five-step reasoning template, enabling the model to learn \textit{how} to analyze logs rather than \textit{what} patterns to memorize. Experimental evaluation demonstrates that CEF-Log achieves an F1-score of 0.99 on the CSIC 2010 dataset using only four examples while providing a $10\times$ improvement in sample efficiency compared to other prompting-based methods. We also introduce ForenWebLog, a new dataset that incorporates real-world attacks and multi-step attack sequences for comprehensive evaluation. Qualitative analysis confirms that CEF-Log generates traceable, accurate explanations suitable for forensic documentation, addressing the critical "black-box" limitation of traditional machine learning approaches.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。