NLLog: Lightweight, Explainable SOC Anomaly Detection via Log-to-Language Rewriting
2026-06-03 • Cryptography and Security
Cryptography and SecurityInformation RetrievalMachine Learning
AI summaryⓘ
The authors created NLLog, a system that rewrites complex security logs into simple sentences describing what happened, who was involved, and how serious it might be. This makes it easier for machines to spot problems and for humans to understand them. They tested NLLog on well-known log datasets and found it works better than some existing methods, while running fast enough for real security work. They also show ways to check if the system needs adjustments before using it and provide clear explanations for alerts. Overall, their approach helps improve detecting and reviewing unusual activity in computer logs.
system-generated logstemplate-based logslog anomaly detectionterm-frequency-inverse-document-frequency (TF-IDF)tree ensemblesTreeSHAPHadoop Distributed File System (HDFS)Blue Gene/L (BGL)security monitoringnatural language processing
Authors
Samuel Ndichu, Tao Ban, Seiichi Ozawa, Takeshi Takahashi, Daisuke Inoue
Abstract
System-generated logs underpin security monitoring, yet their rigid template-based format hinders both automated analysis and human comprehension. We present NLLog (Natural-Language Log), a lightweight pipeline that deterministically rewrites parsed templates into WHO-WHAT-SEVERITY sentences, pools them with term-frequency-inverse-document-frequency weighting, classifies sessions with tree ensembles, and back-projects evidence with TreeSHAP for analyst review. On Hadoop Distributed File System (HDFS) and Blue Gene/L (BGL) corpora, NLLog exceeds two reproduced matched-protocol baselines; across HDFS, BGL, and the AIT Alert Data Set, it sustains low false-positive rates with commodity-hardware latency suitable for security operations center triage. Coverage, sparse-versus-dense, faithfulness, and adversarial ablations show that fallback sufficiency is corpus-dependent, that an enrollment-time coverage check can surface refinement requirements before deployment, and that an auditable deterministic rewrite combined with lightweight dense encoding provides a measurable representation layer for log-anomaly detection and triage.