AI RESEARCH
NLLog: Lightweight, Explainable SOC Anomaly Detection via Log-to-Language Rewriting
arXiv CS.LG
•
ArXi:2606.04957v1 Announce Type: cross System-generated logs underpin security monitoring, yet their rigid template-based format hinders both automated analysis and human comprehension. We present NLLog (Natural-Language Log), a lightweight pipeline that deterministically rewrites parsed templates into WHO-WHAT-SEVERITY sentences, pools them with term-frequency-inverse-document-frequency weighting, classifies sessions with tree ensembles, and back-projects evidence with TreeSHAP for analyst review.