arXiv: From Noise to Signal: Improving Security Log Anomaly Detection Using LLMs with Endpoint-Specific Logs

The publication introduces a research paper proposing a method to improve security log anomaly detection by using large language models trained on endpoint-specific logs, rather than generic data. This is not a regulatory mandate but a technical advancement that could influence how organizations implement AI-driven monitoring under existing frameworks like the EU AI Act, particularly regarding transparency, robustness, and human oversight of AI systems used in cybersecurity.

The primary audience is organizations operating critical infrastructure, financial services, healthcare, and any sector subject to strict data protection and network security obligations, such as those under NIS2 or GDPR. Compliance teams in these sectors should assess whether their current anomaly detection tools rely on generic models that may produce high false-positive rates, and whether adopting endpoint-specific LLMs could improve accuracy while maintaining audit trails and explainability as required by law.

As a next step, compliance professionals should monitor the paper’s validation results and engage with technical teams to evaluate if such models meet the EU AI Act’s risk classification for high-risk AI systems. They should also update their AI risk registers and impact assessments to reflect potential changes in data processing, especially if endpoint logs contain personal data, ensuring that any new detection method remains compliant with data minimization and purpose limitation principles.