Abstract
<title>Abstract</title> <p>Large Language Models (LLMs) are increasingly used in Security Operations Centers (SOC) as tools for analyzing network logs in order to detect anomalies that may indicate network and system attacks being carried out by cybercriminal groups against the monitored infrastructure. Previous works have demonstrated high effectiveness of tools built upon LLMs in detecting such events. However, few works to date address the problem of vulnerability of such LLM-based systems to adversarial attacks, which could lead to a reduction in their anomaly detection capability in network logs. Existing works examining the impact of adversarial attacks such as prompt injection or jailbreak on LLMs show their significant effectiveness in forcing specific, prohibited behaviors or generating content contradicting the safety and ethics guidelines provided in the system prompt. These works, however, largely bypass the topic of anomaly detection in system logs. In the present work, we set out to examine the impact of adversarial Jailbreak attacks on an LLM designed for the task of detecting network and system attacks (anomalies) from system logs. To this end, we designed an adversarial dataset consisting of 7 different types of Jailbreak attacks, adapted by us to introduce disruptions in the classification of network and system attacks by the LLM. Additionally, we present Symbolic Log Shield — our own neurosymbolic architecture wrapping the LLM model in symbolic pre- and postprocessing layers, whose purpose is to protect the classification process against adversarial disturbances. In our research, we tested several LLM models of varying sizes ranging from 2B to 128B parameters, their vulnerability to adversarial attacks, as well as the impact of the proposed architecture on protecting these models against such attacks. Our experiments demonstrated a high vulnerability of the evaluated models to the employed jailbreak attacks, drastically reducing the effectiveness of each of them in system attack detection from a range of 46–84\% AUROC to 26–51\% AUROC. At the same time, the proposed Symbolic Log Shield architecture proved to be highly effective in reducing the negative impact of the employed adversarial attacks, nearly recovering the original metric effectiveness for each model to 72–82\% AUROC, and in the case of some models even improving it by 6–26 percentage points.</p>