Search papers, labs, and topics across Lattice.
This paper introduces HSMLog, a two-stage framework designed for detecting anomalies in Hardware Security Module (HSM) logs through a combination of small language model (SLM) assistance and behavioral analysis. The framework enhances detection accuracy by leveraging HSM-specific operational rules and historical data to validate alerts, achieving high performance metrics such as 98.97% precision and 97.46% F1 score on real industrial logs. These results underscore the effectiveness of integrating language models with domain-specific knowledge to improve security incident analysis and alerting processes.
Achieving nearly 99% precision in anomaly detection, HSMLog redefines how we approach security log analysis in hardware systems.
Hardware Security Module (HSM) logs capture security-critical behavior, but anomalies emerge from relationships across event sequences, keys, object states, sessions, and temporal patterns rather than isolated events. Existing methods separate detection from HSM-specific evidence validation and reporting. In this paper, we present HSMLog, a two-stage framework for HSM log anomaly detection with retrieval-grounded behavioral analysis. In Stage 1, a small language model (SLM) identifies candidate alerts from sliding windows of structured HSM events and performs policy-guided assessment using HSM-specific operational rules. In Stage 2, retrieved policies and historical suspicious-key records strictly predating the alert window, together with candidate-related log context, support conservative candidate review and incident analysis. Evaluated on real industrial HSM background logs augmented with anomaly scenarios co-defined with industrial partners, HSMLog achieves 98.97% precision, 96.00% recall, 98.66% anomalous-event coverage, and a 97.46% F1 score, demonstrating effective anomaly alerting and incident triage in the studied setting.
