{"id":"https://openalex.org/W7164003900","doi":"https://doi.org/10.48550/arxiv.2606.08649","title":"Sample-Efficient LLM-Based Detection of Malicious Web Server Logs with Forensically Explainable Reasoning","display_name":"Sample-Efficient LLM-Based Detection of Malicious Web Server Logs with Forensically Explainable Reasoning","publication_year":2026,"publication_date":"2026-06-07","ids":{"openalex":"https://openalex.org/W7164003900","doi":"https://doi.org/10.48550/arxiv.2606.08649"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.08649","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.08649","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.08649","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5138261838","display_name":"Bernhard Kneip","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kneip, Bernhard","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138256115","display_name":"Nhien-An Le-Khac","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Le-Khac, Nhien-An","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5138204332","display_name":"Hong-Hanh Nguyen-Le","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nguyen-Le, Hong-Hanh","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.37700000405311584,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.37700000405311584,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.13300000131130219,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.07360000163316727,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/sample","display_name":"Sample (material)","score":0.48750001192092896},{"id":"https://openalex.org/keywords/web-server","display_name":"Web server","score":0.3865000009536743},{"id":"https://openalex.org/keywords/web-application","display_name":"Web application","score":0.3797999918460846},{"id":"https://openalex.org/keywords/dual","display_name":"Dual (grammatical number)","score":0.3449999988079071},{"id":"https://openalex.org/keywords/computer-forensics","display_name":"Computer forensics","score":0.34139999747276306},{"id":"https://openalex.org/keywords/qualitative-analysis","display_name":"Qualitative analysis","score":0.32179999351501465}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8014000058174133},{"id":"https://openalex.org/C198531522","wikidata":"https://www.wikidata.org/wiki/Q485146","display_name":"Sample (material)","level":2,"score":0.48750001192092896},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3878999948501587},{"id":"https://openalex.org/C11392498","wikidata":"https://www.wikidata.org/wiki/Q11288","display_name":"Web server","level":3,"score":0.3865000009536743},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.3797999918460846},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3488999903202057},{"id":"https://openalex.org/C2780980858","wikidata":"https://www.wikidata.org/wiki/Q110022","display_name":"Dual (grammatical number)","level":2,"score":0.3449999988079071},{"id":"https://openalex.org/C556601545","wikidata":"https://www.wikidata.org/wiki/Q878553","display_name":"Computer forensics","level":3,"score":0.34139999747276306},{"id":"https://openalex.org/C3018587665","wikidata":"https://www.wikidata.org/wiki/Q7268696","display_name":"Qualitative analysis","level":3,"score":0.32179999351501465},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.3149000108242035},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.31349998712539673},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.29899999499320984},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.29510000348091125},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.2921000123023987},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.28540000319480896},{"id":"https://openalex.org/C58328972","wikidata":"https://www.wikidata.org/wiki/Q184609","display_name":"Expert system","level":2,"score":0.26499998569488525},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2587999999523163},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2583000063896179},{"id":"https://openalex.org/C35578498","wikidata":"https://www.wikidata.org/wiki/Q193424","display_name":"Web service","level":2,"score":0.25220000743865967}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.08649","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.08649","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.08649","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.08649","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.7312621474266052}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Forensic":[0],"analysis":[1,113],"of":[2,70,130],"web":[3],"server":[4],"logs":[5,55],"demands":[6],"both":[7],"accurate":[8,119],"detection":[9],"and":[10,105],"human-readable":[11],"explanations":[12,120],"that":[13,31,65,101,115],"can":[14],"satisfy":[15],"legal":[16],"requirements.":[17],"We":[18,94],"present":[19],"CEF-Log,":[20],"a":[21,42,83,98],"context-enhanced":[22],"few-shot":[23],"chain-of-thought":[24],"prompting":[25],"strategy":[26],"for":[27,109,122],"Large":[28],"Language":[29],"Models":[30],"addresses":[32],"this":[33],"dual":[34],"requirement.":[35],"CEF-Log":[36,66,116],"embeds":[37],"expert":[38],"investigative":[39],"methodology":[40],"through":[41],"structured":[43],"five-step":[44],"reasoning":[45],"template,":[46],"enabling":[47],"the":[48,73,126],"model":[49],"to":[50,53,60,90],"learn":[51],"\\textit{how}":[52],"analyze":[54],"rather":[56],"than":[57],"\\textit{what}":[58],"patterns":[59],"memorize.":[61],"Experimental":[62],"evaluation":[63],"demonstrates":[64],"achieves":[67],"an":[68],"F1-score":[69],"0.99":[71],"on":[72],"CSIC":[74],"2010":[75],"dataset":[76,100],"using":[77],"only":[78],"four":[79],"examples":[80],"while":[81],"providing":[82],"$10\\times$":[84],"improvement":[85],"in":[86],"sample":[87],"efficiency":[88],"compared":[89],"other":[91],"prompting-based":[92],"methods.":[93],"also":[95],"introduce":[96],"ForenWebLog,":[97],"new":[99],"incorporates":[102],"real-world":[103],"attacks":[104],"multi-step":[106],"attack":[107],"sequences":[108],"comprehensive":[110],"evaluation.":[111],"Qualitative":[112],"confirms":[114],"generates":[117],"traceable,":[118],"suitable":[121],"forensic":[123],"documentation,":[124],"addressing":[125],"critical":[127],"\"black-box\"":[128],"limitation":[129],"traditional":[131],"machine":[132],"learning":[133],"approaches.":[134]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-10T00:00:00"}