mlsanityData to 14 Oct 2026

NLLog: Lightweight, Explainable SOC Anomaly Detection via Log-to-Language Rewriting

arXiv 2606.04957 ↗First posted 3 Jun 2026cs.CR cs.IR cs.LGcited by 0

Not on the map. Why?

Abstract (arXiv)

System-generated logs underpin security monitoring, yet their rigid template-based format hinders both automated analysis and human comprehension. We present NLLog (Natural-Language Log), a lightweight pipeline that deterministically rewrites parsed templates into WHO-WHAT-SEVERITY sentences, pools them with term-frequency-inverse-document-frequency weighting, classifies sessions with tree ensembles, and back-projects evidence with TreeSHAP for analyst review. On Hadoop Distributed File System (HDFS) and Blue Gene/L (BGL) corpora, NLLog exceeds two reproduced matched-protocol baselines; across HDFS, BGL, and the AIT Alert Data Set, it sustains low false-positive rates with commodity-hardware latency suitable for security operations center triage. Coverage, sparse-versus-dense, faithfulness, and adversarial ablations show that fallback sufficiency is corpus-dependent, that an enrollment-time coverage check can surface refinement requirements before deployment, and that an auditable deterministic rewrite combined with lightweight dense encoding provides a measurable representation layer for log-anomaly detection and triage.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 17 of its 47 references that are in the map. First posted on arXiv 3 Jun 2026.

Builds on

17 of 47 references.

References · 17

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,170
  3. 2016XGBoost: A Scalable Tree Boosting Systemcited by 5,166
  4. 2017Understanding Black-box Predictions via Influence Functionscited by 1,741
  5. 2020MiniLM: Deep Self-Attention Distillation for Task-Agnostic Compression of Pre-Trained Transformerscited by 1,463
  6. 2018This Looks Like That: Deep Learning for Interpretable Image Recognitioncited by 737
  7. 2021LogBERT: Log Anomaly Detection via BERTcited by 118
  8. 2020Loghub: A Large Collection of System Log Datasets for AI-driven Log Analyticscited by 70
  9. 2021Log-based Anomaly Detection Without Log Parsingcited by 59
  10. 2022Log-based Anomaly Detection with Deep Learning: How Far Are We?cited by 57
  11. 2023LogGPT: Log Anomaly Detection via GPTcited by 26
  12. 2020Self-Supervised Log Parsingcited by 23
5 more
  1. 2021threaTrace: Detecting and Tracing Host-based Threats in Node Level Through Provenance Graph Learningcited by 22
  2. 2024LogLLM: Log-based Anomaly Detection Using Large Language Modelscited by 22
  3. 2023Introducing a New Alert Data Set for Multi-Step Attack Analysiscited by 12
  4. 2022Maintainable Log Datasets for Evaluation of Intrusion Detection Systemscited by 10
  5. 2025LogLLaMA: Transformer-based log anomaly detection with LLaMAcited by 3

Built on by

Not cited yet.