A structured event logging framework for language model assisted security event analysis

In the digital world, every action a computer takes leaves a trace. When a user logs in, when a file is saved, or when a security setting is changed, the system writes a record of that event. These records, known as event logs, are the primary way security teams understand what is happening inside a network. For decades, the standard method for analyzing these logs has been to feed them into specialized software or human analysts who look for patterns that suggest a threat. However, a new generation of artificial intelligence tools, specifically large language models, has shown promise in automating this task. These models are trained on vast amounts of text and can understand natural language, making them theoretically perfect for reading and interpreting the stories hidden within security logs. Yet, a significant problem has emerged: when these powerful AI tools are asked to read standard computer logs, they often fail. They produce inconsistent answers, miss critical details, or invent facts that never happened. This unreliability makes them dangerous for real-world security, where a wrong guess could mean a breach goes unnoticed or a harmless action is mistaken for an attack.

Researchers at the University of Huddersfield and Manchester Metropolitan University set out to solve this problem by asking a different question. Instead of trying to make the artificial intelligence smarter, they wondered if the logs themselves were the problem. They hypothesized that the way computers currently write these records is simply too messy and technical for the AI to understand. To test this, the team developed a new way for computers to record their activities, one designed specifically to be readable by language models. They built a tool that captures events from various parts of a computer system, filters out the noise, and rewrites the data into a clear, structured format before it is ever analyzed. The result is a system where the computer does the heavy lifting of organizing the information, presenting the AI with a clean, coherent story rather than a chaotic stream of code.

The team tested their new approach by simulating twenty different security scenarios, ranging from simple password changes to complex network intrusions. They recorded the events using their new tool and compared the results against standard logging methods used in the industry today. When they fed these logs into several different language models, the difference was stark. The models using the new format consistently identified the correct issues and provided relevant solutions. In contrast, when the same models were given the traditional, unstructured logs, their performance dropped significantly. They struggled to distinguish between normal activity and potential threats, often failing to recognize that a critical security setting had been altered. The new format eliminated the need for the AI to guess or interpret confusing codes, leading to a dramatic improvement in accuracy.

One of the most notable findings was that the new system worked so well that the models rarely made up facts, a phenomenon known as hallucination. In this specific experiment, the error rate was effectively zero across all tests, including those using traditional formats. The researchers noted, however, that this result might be influenced by the relatively small number of logs used compared to other studies, and they could not definitively conclude that hallucinations were permanently eliminated without further testing on larger datasets. This suggests that the primary cause of the AI's confusion was not a lack of intelligence, but rather the poor quality of the input data. By ensuring that the logs were structured, consistent, and written in plain language from the moment they were created, the researchers removed the barriers that caused the AI to stumble. The system also handled the task of linking related events together. Instead of waiting for a separate program to figure out that two different logs happened at the same time and were part of the same attack, the new tool connected these dots automatically as the events occurred.

The researchers also explored whether training the AI models on more data would help them perform better with the old, messy logs. They found that even with extra training, the models still struggled with the traditional formats. However, when using the new format, the models performed exceptionally well even without any additional training. This indicates that the structure of the data is more important than the size of the model's training set. The team measured how long it took to analyze the logs and found that their new method was significantly faster than most traditional methods. While some standard tools like Sysmon completed analysis in minutes, others took multiple hours to process the same amount of information. This speed, combined with the high accuracy, suggests that the new approach could make AI-driven security analysis practical for everyday use.

The study does not claim to have solved every problem in cybersecurity, and the researchers acknowledge that their tests were conducted on a single type of computer system. They plan to expand their work to other operating systems in the future. However, the core discovery is clear: the way we record digital events needs to change if we want artificial intelligence to understand them. By treating the log format as a communication tool rather than just a technical record, the researchers have created a bridge between human machines and artificial intelligence. This simple shift in perspective allows the AI to do what it does best—understand language and find patterns—without getting lost in the noise of raw data. The result is a more reliable, faster, and safer way to protect computer systems, proving that sometimes the best way to improve a tool is not to make it more complex, but to make the information it receives clearer.