The DOI matches its Crossref record; 16 of the 16 references it cites were found in a registry or an index.
CLogLLM: A Large Language Model Enabled Approach to Cybersecurity Log Anomaly Analysis
Abstract
Log data is commonly used to record the status of the system and the events that occur, which are often used to assist security staff to determine whether the system is abnormal, diagnose problems, troubleshooting. However, with the increasing complexity of the system, the log data becomes more and more numerous and complex, Therefore the analysis of the log becomes extremely difficult. Not coincidentally, with the emergence of various system software updates, traditional deep learning-based anomaly detection methods, which rely on pre-existing data for training, often struggle to maintain their effectiveness. At the same time, simply detecting anomalies in significant number of complex log data is no longer meet operational needs. Therefore, LLM which is capable of realizing zero-shot learning and text generation has attracted attention. This paper proposed method which is based on the implementation of LLMs for security log detection and analysis. The approach involves fine-tuning the LLMs to improve their adaptability to complex and diverse log data. Moreover, It incorporates two advanced prompt engineering techniques, ToT and Self-Refine, while also exploring the combination of existing techniques such as CoT and In-Context prompting. These three different prompt engineering methods significantly enhance the LLMs' the accuracy in log anomaly detection and the quality in generation of log anomaly analysis.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
LLMs are capable of zero-shot reasoning over heterogeneous textual artifacts without bespoke feature engineering.
“The first is the emergence of large language models (LLMs) capable of zero-shot reasoning over heterogeneous textual artifacts-packet captures rendered as text, system logs, threat-intelligence reports, MITRE ATT&CK technique descriptions, CVE narratives-without bespoke feature engineering”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [17]
Citations
Cites
Language Models are Few-Shot Learners
Brown, T. B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al. (2020) · arXiv · doi:10.48550/arxiv.2005.14165 · Cited by 23,372
Chain-Of-Thought Prompting Elicits Reasoning in Large Language Models
Wei, J., Wang, X., Schuurmans, D., Bosma, M., Ichter, B., Xia, F., Chi, E., Le, Q. V., & Zhou, D. (2022) · Advances in Neural Information Processing Systems 35 · doi:10.52202/068431-1800 · Cited by 4,505
DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning
Du, M., Li, F., Zheng, G., & Srikumar, V. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3134015 · Cited by 1,835
Parameter-efficient fine-tuning of large-scale pre-trained language models
Ding, N., Qin, Y., Yang, G., Wei, F., Yang, Z., Su, Y., Hu, S., Chen, Y., Chan, C.-M., Chen, W., et al. (2023) · Nature Machine Intelligence · doi:10.1038/s42256-023-00626-4 · Cited by 1,191
Tree of Thoughts: Deliberate Problem Solving with Large Language Models
Yao, S., Yu, D., Zhao, J., Shafran, I., Griffiths, T. L., Cao, Y., & Narasimhan, K. (2023) · arXiv · doi:10.48550/arxiv.2305.10601 · Cited by 1,158
LogAnomaly: Unsupervised Detection of Sequential and Quantitative Anomalies in Unstructured Logs
Meng, W., Liu, Y., Zhu, Y., Zhang, S., Pei, D., Liu, Y., Chen, Y., Zhang, R., Tao, S., Sun, P., et al. (2019) · Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/658 · Cited by 708
A Survey on In-context Learning
Dong, Q., Li, L., Dai, D., Zheng, C., Ma, J., Li, R., Xia, H., Xu, J., Wu, Z., Chang, B., et al. (2024) · Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing · doi:10.18653/v1/2024.emnlp-main.64 · Cited by 649
LogBERT: Log Anomaly Detection via BERT
Guo, H., Yuan, S., & Wu, X. (2021) · 2021 International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn52387.2021.9534113 · Cited by 454
A Survey on Automated Log Analysis for Reliability Engineering
He, S., He, P., Chen, Z., Yang, T., Su, Y., & Lyu, M. R. (2022) · ACM Computing Surveys · doi:10.1145/3460345 · Cited by 334
Loghub: a large collection of system log datasets for AI-driven log analytics
Zhu, J., He, S., He, P., Liu, J., & Lyu, M. R. (2023) · 2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE) · doi:10.1109/issre59848.2023.00071 · Cited by 302
LogGPT: Log Anomaly Detection via GPT
Han, X., Yuan, S., & Trabelsi, M. (2023) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata59044.2023.10386543 · Cited by 98
LogPrompt: Prompt Engineering Towards Zero-Shot and Interpretable Log Analysis
Liu, Y., Tao, S., Meng, W., Yao, F., Zhao, X., & Yang, H. (2024) · Proceedings of the 2024 IEEE/ACM 46th International Conference on Software Engineering: Companion Proceedings · doi:10.1145/3639478.3643108 · Cited by 96
SemParser: A Semantic Parser for Log Analytics
Huo, Y., Su, Y., Lee, C. Q. E., & Lyu, M. R.-T. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse48619.2023.00082 · Cited by 62
LogPrécis: Unleashing language models for automated malicious log analysis
Boffa, M., Drago, I., Mellia, M., Vassio, L., Giordano, D., Valentim, R., & Houidi, Z. B. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103805 · Cited by 50
LogQA: Question Answering in Unstructured LogsPreprint
Huang, S., Liu, Y., Fung, C., Qi, J., Yang, H., & Luan, Z. (2023) · arXiv (Cornell University) · doi:10.48550/arxiv.2303.11715 · Cited by 10
LogBERT: Log Anomaly Detection via BERT
Guo, H., Yuan, S., & Wu, X. (2021) · arXiv · doi:10.48550/arxiv.2103.04475 · Cited by 7
Flagged first, then by citations
Research works printed but not linked: 4
- Hu, 2021, Lora: Low-rank adaptation of large language models[J], arxiv preprint
- Liu, 2021, P-tuning v2: Prompt tuning can be comparable to fine-tuning universally across scales and tasks[J], arxiv preprint
- Madaan, 2024, Self-Refine: Iterative refinement with self-feedback[J], Advances in Neural Information Processing Systems, 36
- Cui, 2024, LogEval: A Comprehensive Benchmark Suite for Large Language Models In Log Analysis[J], arxiv preprint
Cited by
Sorted by citations
Nageshwaran, V., & Ezekiel, S. (2026) · Electronics · doi:10.3390/electronics15122740 · Cited by 4
“%) operate in detection-only mode, with representative examples spanning hybrid LLM-IDS architectures, edge transformers, and BERT-based federated detectors [16,17,65,71–74, 85”
Applications of Large Language Model in HVDC Systems: Concepts, Development, and Perspectives
Wen, X., Chen, H., Wang, N., Song, Y., Qiao, Z., & Zhang, B. (2026) · Energy Engineering · doi:10.32604/ee.2025.073567 · Cited by 1
Diop, M., Bâ, M., Sylla, K., & Ouya, S. (2025) · International Conference on Pattern Recognition and Artificial Intelligence (PRAI) · doi:10.1109/prai67447.2025.11412524
Specialized Neural Architectures vs LLMs for eBPF-Based Software Composition Analysis
Pășcuți, L., & Oprişa, C. (2026) · IEEE International Conference on Automation, Quality and Testing, Robotics (AQTR) · doi:10.1109/aqtr70159.2026.11577789
Web Log Anomaly Detection via Multi-Agent RAG
Hao, Q., & Wang, X. (2026) · International Conference on Big Data & Artificial Intelligence & Software Engineering (ICBASE) · doi:10.1109/icbase70763.2026.11619482
Lightweight Anomaly Detection in Enterprise Wi-Fi Networks Using LoRA-Adapted Small Language Models
Cardoso, T., Duarte, W., Bastos, L., Santos, H., da Costa, A. D. B., & Cerqueira, E. (2026) · Latin American Networking Conference · doi:10.1145/3834582.3834590
Metadata
- Authors
- Ren, H., Lan, K., Sun, Z., & Liao, S.
- Affiliations
- Technology Group Corporation,The 30th Research Institute of China Electronics,Chengdu,China,610041
- Venue
- 2024 4th International Conference on Electronic Information Engineering and Computer Communication (EIECC)
- Publisher
- IEEE
- Published
- 2024-12-27
- Pages
- 963-970
- OpenAlex
- W4408857514
- Cited by
- 5
- References
- 16
- Citations by year
- 2026: 4 · 2025: 1
- FWCI
- 2.18
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- International Conference on Electronic Information Engineering and Computer Communication (EIECC) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Software System Performance and Reliability
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- log anomaly detection, large language models, prompt engineering, zero-shot learning, in-context learning, chain-of-thought prompting, self-refinement, LLM fine-tuning
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
