Influence of Log Structure and Semantic Complexity on the Expediency of BERT-Based Models for Malicious Activity Detection

Abstract

This paper investigates the influence of log structural complexity and semantic obfuscation on the expedience of deploying transformer-based architectures for intrusion detection. While BERT modifications show state-of-the-art performance in natural language processing, their computational overhead in security monitoring requires strict justification. We conduct a comparative analysis of six transformer models against a classical lexical baseline utilizing TF-IDF with Logistic Regression. Evaluations are performed across three heterogeneous datasets representing structured network flows, lexical web attacks, and semantically obfuscated HTTP requests. Results demonstrate that for highly structured and lexically explicit logs, contextual models are redundant. The lexical baseline achieves optimal performance with sub-millisecond latency, outperforming transformers. Conversely, for semantically complex, obfuscated payloads where malicious intent is hidden in context rather than explicit tokens, architectures with disentangled attention and robust pre-training optimization significantly outperform lexical methods. The findings provide practical guidelines and hybrid two-tier architecture for selecting natural language processing models in Security Information and Event Management systems based on data structure and label availability.