基于Phi-4-mini的记忆增强日志分析：增强结构化安全日志中的威胁检测
Memory-Augmented Log Analysis with Phi-4-mini: Enhancing Threat Detection in Structured Security Logs
AI总结：
针对大语言模型在结构化安全日志威胁检测中上下文有限、领域不匹配的问题，提出双记忆RAG框架DM-RAG，结合长短时记忆与Phi-4-mini，在UNSW-NB15数据集上实现更高召回率，支持轻量可扩展的实时威胁监控。
摘要：
结构化安全日志对检测高级持续性威胁（APTs）至关重要。大语言模型（LLMs）因上下文有限和领域不匹配，在该领域表现不佳。我们提出DM-RAG，一种用于结构化日志分析的双记忆检索增强生成框架，它整合了存储近期摘要的短期记忆缓冲区，和存储历史模式的基于FAISS索引的长期记忆。经指令微调的Phi-4-mini处理合并后的上下文并输出结构化预测，贝叶斯融合保障可靠的记忆留存。在UNSW-NB15数据集上，DM-RAG达到53.64%的准确率和98.70%的召回率，召回率优于微调基线和RAG基线。该架构轻量、可解释且可扩展，无需额外语料或大量调优即可实现实时威胁监控。
英文摘要：
Structured security logs are critical for detecting advanced persistent threats (APTs). Large language models (LLMs) struggle in this domain due to limited context and domain mismatch. We propose \textbf{DM-RAG}, a dual-memory retrieval-augmented generation framework for structured log analysis. It integrates a short-term memory buffer for recent summaries and a long-term FAISS-indexed memory for historical patterns. An instruction-tuned Phi-4-mini processes the combined context and outputs structured predictions. Bayesian fusion promotes reliable persistence into memory. On the UNSW-NB15 dataset, DM-RAG achieves 53.64% accuracy and 98.70% recall, surpassing fine-tuned and RAG baselines in recall. The architecture is lightweight, interpretable, and scalable, enabling real-time threat monitoring without extra corpora or heavy tuning.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
