Sample-Efficient LLM-Based Detection of Malicious Web Server Logs with Forensically Explainable Reasoning
Researchers have developed a new method called CEF-Log for using Large Language Models to detect malicious web server logs. This approach uses a structured five-step reasoning template to guide the LLM, improving its ability to analyze logs and generate legally sound explanations. CEF-Log demonstrated high accuracy with minimal examples, achieving an F1-score of 0.99 on a known dataset and showing a tenfold increase in sample efficiency compared to other methods. A new dataset, ForenWebLog, was also introduced to evaluate the system on more complex, real-world attack scenarios. AI
IMPACT Enhances LLM capabilities in cybersecurity by enabling sample-efficient and explainable detection of malicious activities.