Beyond Heavy Log Curation: Perplexity-Based APT Detection via Unsupervised, Context-Augmented Language Models

2026-01-29 · Source: cs.CL updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, extended

Summary

CAPTAIN (Context-Augmented Perplexity-based Threat Activity log detectIoN) is a novel system for detecting Advanced Persistent Threats (APTs) in system logs. Developed by Mitsubishi Electric, CAPTAIN leverages general, pre-trained language models and minimal, domain-agnostic preprocessing to robustly score log entries. It encodes recent log history using a text encoder and a Q-Former-style bridge, injecting compact context tokens into a decoder-only LM to calculate perplexity, which reflects temporal context. To enhance stability, CAPTAIN applies smoothing filters to the perplexity time series. Across APT-oriented benchmarks, CAPTAIN competes with strong baselines like AIRTAG, achieving an average AUC of 0.93 on minimally preprocessed data, and demonstrates superior robustness to increased token budgets and less curated inputs compared to AIRTAG, which saw an average AUC drop of 0.16 when input length increased.

Key takeaway

For AI Security Engineers evaluating log-based threat detection solutions, CAPTAIN offers a robust alternative to methods requiring heavy log curation. Its ability to operate effectively on minimally processed, noisy logs with lightweight language models (e.g., Qwen3-0.6B) means you can reduce preprocessing overhead and deploy detection closer to the host. Consider integrating CAPTAIN to enhance detection stability and reduce operational costs associated with complex feature engineering.

Key insights

CAPTAIN uses context-augmented perplexity from lightweight LMs and minimal preprocessing for robust APT detection in noisy logs.

Principles

• Perplexity-based scoring reflects normal behavior.
• Historical log context improves APT detection.
• Smoothing perplexity time series stabilizes results.

Method

CAPTAIN preprocesses logs minimally, uses a text encoder and Q-Former to inject historical context into a decoder LM for perplexity scoring, then applies a Wiener filter for time-series smoothing.

In practice

• Use DistilBERT and Qwen3-0.6B for lightweight deployment.
• Apply Wiener filter to smooth perplexity scores.

Topics

• Advanced Persistent Threats
• Log Anomaly Detection
• Language Models
• Perplexity Scoring
• Q-Former
• Unsupervised Learning
• Wiener Filter

Best for: Research Scientist, CTO, VP of Engineering/Data, AI Scientist, Machine Learning Engineer, AI Security Engineer

Related on AIssential

• Beyond Heavy Log Curation: Perplexity-Based APT Detection via Unsupervised, Context-Augmented Language Models — CAPTAIN employs context-augmented perplexity from pre-trained language models for APT detection, significantly reducing data curation needs.
• KRONE: Scalable LLM-Augmented Log Anomaly Detection via Hierarchical Abstraction — Krone leverages hierarchical log structures and hybrid LLM-pattern matching for efficient, accurate, and interpretable anomaly detection.
• CRAFTIIF: Cross-Resolution Analytic Four-Type Interpretable Isolation Forest for Multivariate Time Series Anomaly Detection — CRAFTIIF offers interpretable, unsupervised MTSAD by structurally separating anomaly types using wavelet features and dedicated Isolation Forests.
• Cleaning Logs for Downstream Tasks (Registered Report) — LogPurifier cleans logs by removing non-functional, independent messages using dependency scores and clustering.
• The Log Is The Agent - Ishaan Sehgal, Omnara — An AI agent's true identity, history, and state are its durable, append-only event log, not the model or execution environment.
• A Reasoner for Real-World Event Detection: Scaling Reinforcement Learning via Adaptive Perplexity-Aware Sampling Strategy — APARL uses perplexity-aware reinforcement learning and dynamic curriculum to improve abnormal event detection and OOD generalization.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.CL updates on arXiv.org.