SecADLog: LLM-prompted security semantic knowledge-enhanced anomaly detection for cybersecurity logs

Abstract

Network attacks have become increasingly complex and persistent, creating a need for advanced analytical methods that can detect and interpret threats accurately. Large language models (LLMs) and pre-trained language models (PLMs) have recently advanced cybersecurity log analysis. However, direct deployment of LLMs for large-scale online anomaly detection remains constrained by high inference costs, long response latency, and privacy concerns, despite their strong semantic understanding and reasoning capabilities. Smaller PLMs are more suitable for online deployment, but their limited capacity to model contextual dependencies and security-specific semantics can reduce performance in complex log environments. To address these challenges, we propose SecADLog, a security semantic knowledge-enhanced anomaly detection framework for cybersecurity logs. SecADLog uses a structured prompt template tailored to cybersecurity logs to extract stable and consistent security semantics, which are then used to strengthen the representation and reasoning capabilities of smaller PLMs. We further introduce two pretraining tasks: semantic alignment, which aligns log representations with security semantic knowledge, and risk-aware contrastive learning, which improves discriminative ability. Experiments on three cybersecurity log datasets show that SecADLog consistently outperforms existing baseline methods.