RedChronos: A Large Language Model-Based Log Analysis System for Insider Threat Detection in Enterprises

2025-03-04

AI Summary

Enterprise insider threat detection faces significant challenges due to the massive scale of system logs, rendering manual inspection infeasible. This paper introduces RedChronos, an LLM-based automated log analysis framework. Methodologically, it integrates two key innovations: (1) a query-aware weighted voting mechanism to enhance accuracy in multi-LLM collaborative reasoning; and (2) a semantics-driven genetic algorithm that leverages LLM-generated, context-sensitive mutation operators for adaptive log parsing and anomaly scoring. Evaluated on the CERT 4.2/5.2 benchmarks, RedChronos achieves performance on par with or exceeding current state-of-the-art methods. In a real-world SOC deployment at Xiaohongshu, it reduces human verification effort by 90%, markedly improving detection efficiency and scalability.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: Fact-Checking / Misinformation Detection (NLP Focus)
• Humans and AI: Human-in-the-loop Machine Learning

Application Category

• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• Economics, Online Markets and Human Computation: LLM based quality controls for crowd work
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs

Abstract

Internal threat detection aims to address security threats within organizations or enterprises by identifying potential or already occurring malicious threats within vast amounts of logs. Although organizations or enterprises have dedicated personnel responsible for reviewing these logs, it is impossible to manually examine all logs entirely. In response to the vast number of logs, we propose a system called RedChronos, which is a Large Language Model-Based Log Analysis System. This system incorporates innovative improvements over previous research by employing Query-Aware Weighted Voting and a Semantic Expansion-based Genetic Algorithm with LLM-driven Mutations. On the public datasets CERT 4.2 and 5.2, RedChronos outperforms or matches existing approaches in terms of accuracy, precision, and detection rate. Moreover, RedChronos reduces the need for manual intervention in security log reviews by 90% in the Xiaohongshu SOC. Therefore, our RedChronos system demonstrates exceptional performance in handling Internal Threat Detection (IDT) tasks, providing innovative solutions for these challenges. We believe that future research can continue to enhance the system's performance in IDT tasks while also reducing the response time to internal risk events.

Problem

• Detects insider threats using large language models
• Reduces manual log review by 90% in enterprises
• Improves accuracy and precision in threat detection

Innovation

• Large Language Model-Based Log Analysis
• Query-Aware Weighted Voting Technique
• Semantic Expansion-based Genetic Algorithm