2026· International Conference on Security and Cryptography· pp. 885-890· 0 citations· 15 references
Computer Science
TL;DR
LogFusion is presented, a lightweight preprocessing pipeline that fuses contextual embeddings of log messages with engineered behavioural indicators to produce machine learning-ready features for unsupervised anomaly detection algorithms.
Abstract
: The increasing frequency and sophistication of cyber-attacks continue to expose vulnerabilities in modern digital infrastructures. System logs provide a rich source of evidence for detecting such threats, but raw logs are noisy, heterogeneous, and imbalanced, making them inconvenient for direct machine learning applications. This paper presents LogFusion, a lightweight preprocessing pipeline that fuses contextual embeddings of log messages with engineered behavioural indicators (e.g., temporal windows, event rarity, and log-level dynamics) to produce machine learning-ready features for unsupervised anomaly detection algorithms. Evaluated on three public benchmark datasets (HDFS, BGL, and OpenStack), LogFusion increases anomaly detection accuracy from 51 – 61% (raw Bag-of-Words baseline) to 84 – 98% across all detectors, with consistently high recall (>0.95 on HDFS and OpenStack). On HDFS, LogFusion-OCSVM achieves 87% F1-score, outperforming LogBERT (82.32%) and other deep learning baselines. Runtime profiling confirms end-to-end processing under 13 seconds on CPU-only hardware, demonstrating practical feasibility for resource-constrained deployments in SMEs and IoT/edge environments.
Distributed Denial-of-Service (DDoS) attacks across cloud, edge, and Internet-of-Things infrastructures have intensified the need for detectors that are accurate, computationally efficient, and deployable at resource-constrained monitoring points. Much of the intrusion-detection literature implicitly links detection quality to architectural depth, larger parameter spaces, and richer learned representations. This paper examines a narrower hypothesis: for binary flow-level DDoS detection, a carefully engineered shallow pipeline can retain high detection quality while maintaining a compact computational footprint. We propose ShallowNet, a single-hidden-layer neural detector integrated with leakage-aware data partitioning, training-only normalization, principled feature selection, class-imbalance-aware optimization, early stopping, and calibration-guided threshold selection. The evaluation extends beyond standard held-out accuracy by incorporating cross-day temporal transfer, leave-one-attack-family-out robustness testing, controlled baseline comparison, systematic pipeline ablation, and probability-calibration analysis. The results show both the empirical utility and the limits of the approach: class concentration in widely used benchmark datasets can make aggregate metrics overly optimistic, and generalization degrades most sharply when the test traffic contains attack signatures absent from training. These findings suggest that, in lightweight binary flow-level DDoS detection, disciplined pipeline design can be as important as model depth and that stress-tested evaluation should accompany high benchmark accuracy claims.
Ali Alfatemi, Mohamed Rahouti, A. Chehri et al.· IEEE Transactions on Network...· 0 citations
An explainable deep learning framework evaluated across multiple heterogeneous cyber attack datasets, including Kitsune, Server-Based network data,enterprise logs, and Malware Traffic datasets, demonstrating the effectiveness of the proposed framework in handling heterogeneous network traffic while providing interpretable insights into model predictions.
Extensive experiments demonstrate that MeCoLog consistently outperforms state-of-the-art baselines under few-shot cross-system settings, offering a robust and highly transferable solution for real-world log anomaly detection.
Manh Tuan Nguyen, Tuan Phong Tran, Le Dinh Trang Dang et al.· PLoS ONE· 0 citations
Anomaly detection plays a pivotal role in ensuring the reliability of modern large-scale distributed systems. However, traditional log anomaly detection systems are centralized, which poses the risk of privacy leakage during data transmission. Previous research mainly focuses on single-domain logs,requiring domain-specific models and retraining, which limits flexibility and scalability. Significant advancements have been made by Large Language Models (LLMs) in the domains of natural language understanding and automated content creation. However,they still face persistent problems, including substantial computational costs and inadequate availability of training data. The combination of Federated Learning (FL) and LLMs (federated LLMs) offers a solution by leveraging distributed data while protecting privacy, which positions it as an ideal choice for sensitive domains. In this paper, we propose a unified online log anomaly detection framework, FLMLog, which is based on federated Learning and large language model. To enhance the operational efficiency, the FLMLog framework adopts a prefix-aware in-context learning (ICL) refinement strategy. This strategy is specifically designed to refine both the selection of in-context examples and the per-mutation order of these examples, thereby achieving an improvement in prefix caching efficiency. Our experiments demonstrate that the FLMLog framework is rigorously evaluated on five publicly available production log datasets, and the results show that it achieves superior comprehen-sive performance, outperforming state-of-the-art methods in F1-score on four out of five datasets with remarkable improvements.
Shuai Xu· Poster Volume 0008 The 2026...· 0 citations
Large language models (LLMs) embedded in enterprise workflows cannot structurally distinguish legitimate instructions from adversarial ones in the same token stream, making prompt injection OWASP's top LLM risk for two consecutive editions a persistent threat across direct and indirect vectors. This paper presents PromptShield-RT, a layered, real-time, model-agnostic framework combining input normalization and provenance tagging, lexical-heuristic pattern matching, a statistical classifier, structural anomaly features, and calibrated risk fusion, with policy-driven mitigation (allow/sanitize/quarantine/block) and an explainable, adaptive-feedback mechanism for SOC workflows. We construct an original evaluation corpus, SynPI-Bench (n = 450, six categories), and a template-disjoint held-out generalization set (n = 31) with novel phrasings, obfuscation encodings, and adversarial hard-negative benign text. Using template-grouped 5-fold cross-validation, the fused pipeline achieves 92.4% accuracy (F1 = 0.930, AUC = 0.990), outperforming heuristic-only (57.0%) and naive-averaged (59.2%) baselines, while a lexical classifier reaches 85.9% with lower precision. We report a pronounced generalization gap on the held-out set (48.4% accuracy, 90% false-positive rate on hard negatives), quantifying a known limitation of surface-lexical defenses. The pipeline achieves sub-millisecond P95 latency (0.266 ms), within typical 50 ms enterprise SLAs. We situate PromptShield-RT relative to structural, architectural, and guardrail-product defenses, arguing for layered, defense-in-depth architectures, with reproducible code provided.
Fatimah Alhamzawi· Al-Noor Journal of Engineeri...· 0 citations
HTTP Flood attacks remain difficult to detect because they operate at the application layer, resemble legitimate user requests, and generate burst-based temporal traffic patterns. Previous DDoS detection studies often rely on outdated datasets, process network flows as independent records, insufficiently address class imbalance, and provide limited interpretability for security analysts. This study proposes a sequence-aware and explainable deep learning framework for HTTP Flood detection using Long Short-Term Memory (LSTM). Reconstructed HTTP traffic from the UNSW-NB15 dataset was processed through proxy labeling, data cleaning, feature normalization, and sliding-window transformation to convert flow-level records into temporal sequences. Class weighting and SMOTE oversampling were evaluated to mitigate imbalance, while SHAP and LIME were used to explain model decisions. The proposed LSTM model achieved an attack recall of 94.8%, a false negative rate of 5.2%, balanced accuracy of 94.3%, MCC of 0.824, and ROC-AUC of 0.975. The results show that temporal representation improves detection of bursty HTTP Flood behavior, whereas class weighting provides a better balance between attack sensitivity and false-alarm control. Explainability analysis further confirms that the model relies on technically meaningful indicators, including packet rate, flow duration, traffic asymmetry, and service concentration. This framework supports interpretable early-warning detection for application-layer DDoS attacks.
