AI for Scalable Defensive Cyber Log Analysis
Name
Schofield_AI for Scalable Defensive Cyber Log Analysis.pdf
Description
Main Report
Size
1.89 MB
Format
Adobe PDF
Checksum (MD5)
ac4cb924b8bdc962edcf3429d4e5d191
Author(s)
Schofield, Catherine
Jananthan, Hayden
Kepner, Jeremy
Date Issued
March 20, 2026
Abstract
Centralized cyber logging platforms ingest large
volumes of heterogeneous telemetry, yet high dimensionality
and query-driven workflows often limit scalable analytic insight
on these systems. This work presents an automated pipeline
for ingesting, characterizing, and analyzing large-scale hostbased
logs using sparse representations and distribution-aware
statistics. A systematic dimensional analysis reduces hundreds of
raw log fields to a small set of informative dimensions suitable
for aggregation across extended time windows. Temporal analysis
of the reduced representation reveals coordinated deviations
in activity volume and distributional behavior that are not
apparent in individual log streams. The results demonstrate that
dimensional reduction enables scalable, interpretable analysis
of enterprise cyber telemetry. Furthermore, these results were
obtained using host-based sensors designed for event-oriented
point-defense and demonstrate the feasibility of integrating such
sensors to enable long-range, long-duration area defense.
Subjects
defensive cyber operations, log analysis, anomaly detection, sparse matrices, enterprise networks
MIT Department
Lincoln Laboratory
Persistent DSpace Link
