arXiv:2605. 22779v2 Announce Type: replace-cross Abstract: Production systems generate millions of log lines daily, yet most anomaly detectors operate at the session or window-level, flagging groups of lines rather than identifying the specific message responsible.
By Huanchi Wang, Zihang Huang, Yifang Tian, Kristina Dzeparoska, Hans-Arno Jacobsen, Alberto Leon-Garcia
The paper introduces LoRD, a lightweight post‑hoc calibration framework designed to improve confidence reliability in language‑model‑based log anomaly detectors. LoRD learns route‑specific reliability models from latent representations of correctly classified validation samples and uses reconstruction distances to estimate prediction reliability. By selectively recalibrating high‑risk predictions, LoRD reduces overconfident errors while maintaining strong anomaly detection performance across four large‑scale log benchmark datasets.
By Bin Li, Dongdong Wang, Siyang Lu
SecJev is a family of Jev-like decision models specialized for security, ranging from 0.8 B to 9 B parameters. Built on Kev’s single‑pass candidate scorer, it learns Boolean, choice, and ordered decisions from text, telemetry, and observation histories, and is trained on the SecJev‑Corpus that unifies source‑label prediction and explicit‑policy evaluation across 14 tasks and eight sources. The security specialization improves every model, with SecJev‑0.8B outperforming general Kev‑9B by 20.51 percentage points in task‑macro accuracy and matching generative fine‑tuning in accuracy and latency while using less peak inference memory.
By Zheng Chen, Fei Yu, Haohao Huang, Yang Li, Anlong Chen, Lei Chen
SecLog-Bench is a new benchmark designed to evaluate large language models on cybersecurity log reasoning. It features an extensible simulation platform covering 29 attack scenarios, uses multi‑source logs (audit, application, network traffic), and provides dense annotations with step‑by‑step evidence chains. Evaluation of eight mainstream LLMs shows modest performance, with the best model achieving 44.44% accuracy and 45.07% Macro‑F1, and even correct predictions often accompanied by flawed reasoning.
arXiv:2607. 20832v1 Announce Type: cross Abstract: Advanced Persistent Threats (APTs) remain difficult to detect because only a small fraction of events in large-scale logs are attack-related, and investigation is expensive and hard to scale.
By Shoya Otsu, Kei Suzuki, Toshiaki Koike-Akino, Jing Liu, Ye Wang
The paper investigates how different adaptation strategies, model architectures, parameter scales, and quantization settings influence the performance, efficiency, and robustness of large language models (LLMs) for log anomaly detection. Across three public log datasets, the study finds that adaptation strategies lead to significant performance variations, model scaling offers dataset‑dependent gains, and models with similar accuracy can differ markedly in computational cost. Low‑bit quantization largely preserves detection performance, and the authors also assess robustness to structural, semantic, and label noise at varying perturbation levels.
By Bin Li, Dongdong Wang, Siyang Lu