NLP for security log analysis : Learning to crawl before you run
summary
Uses a fine-tuned DistilBERT to convert kubernetes audit logs into vector representations, training on ~7,500 samples to predict verb types and extract embeddings for downstream tasks. Tokenization uses prebuilt vocabularies, visualizes clusters that separate verb classes, and spots a simulated secret‑dump as an isolated anomaly. Shows practical choices (pretrained over from‑scratch, cosine similarity for retrieval), notes limited data, interpretability issues, and that ML complements but does not replace static rules.
AI-written summary · about
chapters (12)
- 0:00Introduction to talk
- 1:47Security logs as language
- 3:57Embeddings for detection
- 7:51Choosing the right model
- 10:39Kubernetes logs deep dive
- 12:49Tokenization process
- 14:32Embedding model selection
- 16:39Evaluating embeddings
- 18:28Detecting secret dumping
- 21:37Challenges ahead
- 23:23Future of models in security
- 24:08Closing remarks
related talks
47m Natural Language Processing & Anomaly detection in Sys call logs
24mHow to numerically represent semi-structured log data for...
10mML-based Log Analysis for Faster Debugging
40mBot or Not? The Illusion of Intelligence
31mTaking AI/ML to the next level: Text!
12mUnlocking the Power of NLP: Techniques in K8s-Native Applications
26mCommand line language – where NLP and cyber security meets
01h 07mEmpowering Security Teams with Generative AI