A Unified Log-Processing Framework for Multi-Source SIEM-Based Intrusion Detection

Abstract

Enterprise intrusions rarely being recorded in just one device. In practice, defenders must correlate DNS, web, authentication, process, and network-flow evidence, yet many learning-based pipelines still analyze each source independently or combine signals only after separate prediction. This paper presents a unified representation for heterogeneous SIEM logs that maps users, hosts, IP addresses, domains, and processes into a shared temporal interaction space while preserving source-specific event attributes. We study two modeling strategies over this representation: a sequential LSTM over the temporally ordered event stream and a temporal graph model over the induced interaction structure. On the AIT and LANL benchmarks, unified multi-source training improves detection quality relative to single-source baselines in our setting and reduces false positives, with the LSTM consistently outperforming the graph baseline. A production deployment over four enterprise log sources further suggests that the representation can be extended beyond the public benchmarks, although recall in that environment remains unmeasured. Overall, the results indicate that cross-source SIEM integration is a promising direction for enterprise intrusion detection while also underscoring the need for careful baseline design, temporally correct evaluation, and reproducible preprocessing.