How It Works
This demonstration reflects the LogLLM-based anomaly-detection methodology developed during the internship. It presents a fixed, simulated outcome in the interface; it does not process or transmit production data.
About the internship
This project presents part of my work done at SecuLabs. It focused on developping and training security LLM models, such as LogLLM for log anomaly detection: strengthening the instruction prompt, training on diverse data, constraining the output to a dependable normal/anomalous decision, and adding an interpretation stage that gives security engineers useful context and action hints.
1. Encoding the log sequence
Each chronological log message is represented by a BERT encoder. A linear projector aligns the message vectors with the causal LLM hidden dimension, forming an embedded sequence suitable for LogLLM.
2. Modified LogLLM prompt and binary decision
The model receives an explicit instruction that frames the embedded sequence as an anomaly-detection task. An answer prefix, The sequence is, guides completion. The output is constrained to either The sequence is normal. or The sequence is anomalous., which makes downstream parsing and evaluation more reliable.
Parameter-efficient LoRA adapters and 4-bit quantization support an efficient fine-tuning and inference pipeline.
3. Interpretation for security analysts
When a sequence is classified as anomalous, an interpretation stage turns that binary decision into a concise analyst-facing assessment. It summarizes the finding, extracts evidence, estimates severity, and proposes immediate action hints.
- Evidence can include repeated authentication failures, privilege escalation, or unusual network destinations.
- Severity is mapped to Low, Medium, or High using heuristics and LLM reasoning.
- Action hints can include isolating a host, rotating credentials, increasing logging, or correlating with IDS alerts.
4. Data and evaluation
The methodology was evaluated with HDFS v1 and CIC UNSW NB15 log data. In the reported experimental setting, the approach achieves up to 99.999% accuracy. The Streamlit prototype supported data ingestion, preprocessing, inference, interpretation, and comparable measurements including precision, recall, F1, accuracy, execution time, and resource use.