{"id":"https://openalex.org/W4413222984","doi":"https://doi.org/10.3390/jcp5030055","title":"Leveraging Large Language Models for Scalable and Explainable Cybersecurity Log Analysis","display_name":"Leveraging Large Language Models for Scalable and Explainable Cybersecurity Log Analysis","publication_year":2025,"publication_date":"2025-08-10","ids":{"openalex":"https://openalex.org/W4413222984","doi":"https://doi.org/10.3390/jcp5030055"},"language":"en","primary_location":{"id":"doi:10.3390/jcp5030055","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5030055","pdf_url":null,"source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.3390/jcp5030055","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5086780842","display_name":"Giulia Palma","orcid":"https://orcid.org/0000-0003-1330-4735"},"institutions":[{"id":"https://openalex.org/I102064193","display_name":"University of Siena","ror":"https://ror.org/01tevnk56","country_code":"IT","type":"education","lineage":["https://openalex.org/I102064193"]}],"countries":["IT"],"is_corresponding":true,"raw_author_name":"Giulia Palma","raw_affiliation_strings":["Dipartimento di Scienze Sociali Politiche e Cognitive, Universit\u00e0 degli Studi di Siena, 53100 Siena, Italy"],"raw_orcid":"https://orcid.org/0000-0003-1330-4735","affiliations":[{"raw_affiliation_string":"Dipartimento di Scienze Sociali Politiche e Cognitive, Universit\u00e0 degli Studi di Siena, 53100 Siena, Italy","institution_ids":["https://openalex.org/I102064193"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5117606883","display_name":"Gaia Cecchi","orcid":null},"institutions":[{"id":"https://openalex.org/I102064193","display_name":"University of Siena","ror":"https://ror.org/01tevnk56","country_code":"IT","type":"education","lineage":["https://openalex.org/I102064193"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Gaia Cecchi","raw_affiliation_strings":["Dipartimento di Scienze Sociali Politiche e Cognitive, Universit\u00e0 degli Studi di Siena, 53100 Siena, Italy"],"raw_orcid":"https://orcid.org/0009-0008-5892-0156","affiliations":[{"raw_affiliation_string":"Dipartimento di Scienze Sociali Politiche e Cognitive, Universit\u00e0 degli Studi di Siena, 53100 Siena, Italy","institution_ids":["https://openalex.org/I102064193"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5114852239","display_name":"Mario Caronna","orcid":null},"institutions":[{"id":"https://openalex.org/I102064193","display_name":"University of Siena","ror":"https://ror.org/01tevnk56","country_code":"IT","type":"education","lineage":["https://openalex.org/I102064193"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Mario Caronna","raw_affiliation_strings":["Dipartimento di Scienze Sociali Politiche e Cognitive, Universit\u00e0 degli Studi di Siena, 53100 Siena, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Dipartimento di Scienze Sociali Politiche e Cognitive, Universit\u00e0 degli Studi di Siena, 53100 Siena, Italy","institution_ids":["https://openalex.org/I102064193"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5035476485","display_name":"Antonio Rizzo","orcid":"https://orcid.org/0000-0002-4096-8150"},"institutions":[{"id":"https://openalex.org/I102064193","display_name":"University of Siena","ror":"https://ror.org/01tevnk56","country_code":"IT","type":"education","lineage":["https://openalex.org/I102064193"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Antonio Rizzo","raw_affiliation_strings":["Dipartimento di Scienze Sociali Politiche e Cognitive, Universit\u00e0 degli Studi di Siena, 53100 Siena, Italy"],"raw_orcid":"https://orcid.org/0000-0002-4096-8150","affiliations":[{"raw_affiliation_string":"Dipartimento di Scienze Sociali Politiche e Cognitive, Universit\u00e0 degli Studi di Siena, 53100 Siena, Italy","institution_ids":["https://openalex.org/I102064193"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5086780842"],"corresponding_institution_ids":["https://openalex.org/I102064193"],"apc_list":{"value":1000,"currency":"CHF","value_usd":1207},"apc_paid":{"value":1000,"currency":"CHF","value_usd":1207},"fwci":7.48,"has_fulltext":true,"cited_by_count":13,"citation_normalized_percentile":{"value":0.9742581,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":100},"biblio":{"volume":"5","issue":"3","first_page":"55","last_page":"55"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9950000047683716,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9945999979972839,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/interpretability","display_name":"Interpretability","score":0.8009054660797119},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7766813039779663},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.6082289218902588},{"id":"https://openalex.org/keywords/benchmarking","display_name":"Benchmarking","score":0.5877751111984253},{"id":"https://openalex.org/keywords/pipeline","display_name":"Pipeline (software)","score":0.571921169757843},{"id":"https://openalex.org/keywords/random-forest","display_name":"Random forest","score":0.5552911162376404},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5268213748931885},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.5052011609077454},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.4788805842399597},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.47513702511787415},{"id":"https://openalex.org/keywords/big-data","display_name":"Big data","score":0.4497246742248535},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.42969810962677},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.428158700466156},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.39816898107528687},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3140154182910919},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.18408015370368958},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.16087046265602112},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.10763147473335266},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.08061867952346802}],"concepts":[{"id":"https://openalex.org/C2781067378","wikidata":"https://www.wikidata.org/wiki/Q17027399","display_name":"Interpretability","level":2,"score":0.8009054660797119},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7766813039779663},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.6082289218902588},{"id":"https://openalex.org/C86251818","wikidata":"https://www.wikidata.org/wiki/Q816754","display_name":"Benchmarking","level":2,"score":0.5877751111984253},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.571921169757843},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.5552911162376404},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5268213748931885},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.5052011609077454},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.4788805842399597},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.47513702511787415},{"id":"https://openalex.org/C75684735","wikidata":"https://www.wikidata.org/wiki/Q858810","display_name":"Big data","level":2,"score":0.4497246742248535},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.42969810962677},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.428158700466156},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.39816898107528687},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3140154182910919},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.18408015370368958},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.16087046265602112},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.10763147473335266},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.08061867952346802},{"id":"https://openalex.org/C201995342","wikidata":"https://www.wikidata.org/wiki/Q682496","display_name":"Systems engineering","level":1,"score":0.0},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.0},{"id":"https://openalex.org/C162853370","wikidata":"https://www.wikidata.org/wiki/Q39809","display_name":"Marketing","level":1,"score":0.0},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.3390/jcp5030055","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5030055","pdf_url":null,"source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},{"id":"pmh:oai:usiena-air.unisi.it:11365/1304941","is_oa":true,"landing_page_url":"https://www.mdpi.com/2624-800X/5/3/55","pdf_url":"https://www.mdpi.com/2624-800X/5/3/55/pdf?version=1754799627","source":{"id":"https://openalex.org/S4377196319","display_name":"Use Siena air (University of Siena)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I102064193","host_organization_name":"University of Siena","host_organization_lineage":["https://openalex.org/I102064193"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/article"},{"id":"pmh:oai:doaj.org/article:cdd15b3f06904031ac2dc43ff1729c54","is_oa":true,"landing_page_url":"https://doaj.org/article/cdd15b3f06904031ac2dc43ff1729c54","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Journal of Cybersecurity and Privacy, Vol 5, Iss 3, p 55 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/jcp5030055","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5030055","pdf_url":null,"source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G675437911","display_name":null,"funder_award_id":"2021 2027","funder_id":"https://openalex.org/F4320335322","funder_display_name":"European Regional Development Fund"}],"funders":[{"id":"https://openalex.org/F4320335322","display_name":"European Regional Development Fund","ror":"https://ror.org/00k4n6c32"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":43,"referenced_works":["https://openalex.org/W1968411139","https://openalex.org/W2217197715","https://openalex.org/W2295598076","https://openalex.org/W2296719434","https://openalex.org/W2762776925","https://openalex.org/W2768348081","https://openalex.org/W2911964244","https://openalex.org/W3027879771","https://openalex.org/W3042356186","https://openalex.org/W3144192494","https://openalex.org/W3179245071","https://openalex.org/W3215966579","https://openalex.org/W4225591000","https://openalex.org/W4292779060","https://openalex.org/W4309674289","https://openalex.org/W4353090637","https://openalex.org/W4366090965","https://openalex.org/W4381569470","https://openalex.org/W4390490761","https://openalex.org/W4390616416","https://openalex.org/W4399477206","https://openalex.org/W4401863746","https://openalex.org/W4402270600","https://openalex.org/W4403389808","https://openalex.org/W4404579667","https://openalex.org/W4404817466","https://openalex.org/W4405292220","https://openalex.org/W4405599495","https://openalex.org/W4405642018","https://openalex.org/W4406928793","https://openalex.org/W4407388754","https://openalex.org/W4408145721","https://openalex.org/W4408363154","https://openalex.org/W4408565663","https://openalex.org/W4409894446","https://openalex.org/W4410170696","https://openalex.org/W4410319648","https://openalex.org/W4411183121","https://openalex.org/W6777615688","https://openalex.org/W6778883912","https://openalex.org/W6849590751","https://openalex.org/W6856439586","https://openalex.org/W7007923404"],"related_works":["https://openalex.org/W4238897586","https://openalex.org/W2905433371","https://openalex.org/W435179959","https://openalex.org/W2619091065","https://openalex.org/W2059640416","https://openalex.org/W1490753184","https://openalex.org/W2284465472","https://openalex.org/W2291782699","https://openalex.org/W1993948687","https://openalex.org/W4361806667"],"abstract_inverted_index":{"The":[0],"increasing":[1],"complexity":[2],"and":[3,17,34,55,74,108,151],"volume":[4],"of":[5,13,24,70,96,135],"cybersecurity":[6,37],"logs":[7],"demand":[8],"advanced":[9,145],"analytical":[10],"techniques":[11],"capable":[12],"accurate":[14],"threat":[15,146,160],"detection":[16,87,147],"explainability.":[18],"This":[19],"paper":[20],"investigates":[21],"the":[22,91,119,133,153],"application":[23],"Large":[25],"Language":[26],"Models":[27],"(LLMs),":[28],"specifically":[29],"qwen2.5:7b,":[30],"gemma3:4b,":[31],"llama3.2:3b,":[32],"qwen3:8b":[33],"qwen2.5:32b":[35],"to":[36,45,77,115],"log":[38],"classification,":[39],"demonstrating":[40],"their":[41,156],"superior":[42,116],"performance":[43],"compared":[44],"traditional":[46],"machine":[47],"learning":[48],"models":[49],"such":[50],"as":[51,137],"XGBoost,":[52],"Random":[53],"Forest,":[54],"LightGBM.":[56],"We":[57],"present":[58],"a":[59,85],"comprehensive":[60],"evaluation":[61],"pipeline":[62],"that":[63,90],"integrates":[64],"domain-specific":[65],"prompt":[66],"engineering,":[67],"robust":[68],"parsing":[69],"free-text":[71],"LLM":[72,92,120],"outputs,":[73],"uncertainty":[75],"quantification":[76],"enable":[78],"scalable,":[79],"automated":[80],"benchmarking.":[81],"Our":[82],"experiments":[83],"on":[84],"vulnerability":[86],"task":[88],"show":[89],"achieves":[93],"an":[94],"F1-score":[95],"0.928":[97],"([0.913,":[98],"0.942]":[99],"95%":[100],"CI),":[101],"significantly":[102],"outperforming":[103],"XGBoost":[104],"(0.555":[105],"[0.520,":[106],"0.590])":[107],"LightGBM":[109],"(0.432":[110],"[0.380,":[111],"0.484]).":[112],"In":[113],"addition":[114],"predictive":[117],"performance,":[118],"generates":[121],"structured,":[122],"domain-relevant":[123],"explanations":[124],"aligned":[125],"with":[126],"classical":[127],"interpretability":[128],"methods.":[129],"These":[130],"findings":[131],"highlight":[132],"potential":[134],"LLMs":[136],"interpretable,":[138],"adaptive":[139],"tools":[140],"for":[141,149,155],"operational":[142],"cybersecurity,":[143],"making":[144],"feasible":[148],"SMEs":[150],"paving":[152],"way":[154],"deployment":[157],"in":[158],"dynamic":[159],"environments.":[161]},"counts_by_year":[{"year":2026,"cited_by_count":11},{"year":2025,"cited_by_count":2}],"updated_date":"2026-08-25T07:29:55.448023","created_date":"2025-10-10T00:00:00"}