用大模型提升日志异常检测，特别擅长识别边界异常行为。
From Noise to Signal: Improving Security Log Anomaly Detection Using LLMs with Endpoint-Specific Logs
- 设计指令微调框架，结合终端特定日志数据进行异常分类。
- Meta Llama 3.1 准确率达89.3%，误检率仅11.8%，显著优于传统方案。
- 能有效识别80%的边界异常，适合安全运维与威胁狩猎场景。
现有日志异常检测方法如Wazuh依赖预设规则，OpenSearch基于统计偏差，而近期研究尝试利用大模型（LLM）捕捉语义与上下文信息。然而，现有方法受提示工程、噪声数据及通用数据集局限，难以覆盖终端特异性认证行为。为此，本文构建标准化指令式LLM分类框架，通过可控网络安全测试床生成终端特异性认证数据，形成包含正常、边界与异常行为的标注数据集。评估了Meta Llama 3.1 8B Instruct、Qwen 2.5 7B Instruct和GPT-OSS 20B三款指令微调模型，对比Wazuh与OpenSearch Anomaly Detection。结果表明，Meta Llama 3.1 在端到端检测中表现最优，准确率89.3%，召回率88.2%，F1-score 91.8%，误报率11.8%；而Wazuh准确率52.0%，误报率68.6%；OpenSearch准确率49.3%，误报率74.5%。同时，其可检测80%边界异常，远超Wazuh的20%与OpenSearch的15%。Qwen虽整体性能较低，但推理延迟最低，响应结构化率达100%。GPT-OSS在有效响应下表现出强分类能力。
原文摘要 · Abstract (English)
Existing approaches to anomalous behaviour log detection, such as Wazuh rely primarily on predefined detection rules, while statistical anomaly detection approaches such as OpenSearch identify deviations from previously observed behavioural patterns. Recent research has investigated LLMs for log anomaly detection because of their ability to interpret semantic and contextual information. However, LLM-based approaches can be affected by prompt construction, noisy log data, and reliance on generic datasets that may lack endpoint-specific authentication behaviours. To address these limitations, this study develops a standardised instruction-based LLM classification framework for detecting anomalous authentication behaviours, including borderline cases. A controlled cybersecurity testbed was developed to generate endpoint-specific authentication data, producing a curated dataset comprising normal, borderline, and anomalous behavioural scenarios. Three instruction-tuned LLMs, Meta Llama 3.1 8B Instruct, Qwen 2.5 7B Instruct, and GPT-OSS 20B, were evaluated against Wazuh rule-based detection and OpenSearch Anomaly Detection using a common ground-truth severity framework. Meta Llama 3.1 8B Instruct achieved the strongest overall end-to-end detection performance, with an accuracy of 89.3%, recall of 88.2%, F1-score of 91.8%, and false negative rate of 11.8%. In comparison, Wazuh achieved an accuracy of 52.0% and false negative rate of 68.6%, while OpenSearch achieved an accuracy of 49.3% and false negative rate of 74.5%. Meta Llama also detected 80% of the borderline anomalous scenarios, compared with 20% for Wazuh and 15% for OpenSearch. Qwen achieved lower overall detection performance than Meta Llama but recorded the lowest average inference latency and 100% structured-response validity. GPT-OSS demonstrated strong classification performance when valid responses were produced.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。