Datasetpublic

mbitai/secops-2k-trail-baseline

SecOps-2k Trail baseline Trail's parse of the SecOps-2k synthetic security logs, with the per-decision audit trail. Trail is a deterministic template miner: no model involved in these numbers. Each parsed line gets a template plus a receipt showing the exact decision that produced it. Author: MbitAI. Parser code: TMFNK/LogParser-Trail. Archived release: doi:10.5281/zenodo.22484287. Companion paper: trail-techreport.pdf in the code repo. What is inside File… See the full description on the dataset page: https://huggingface.co/datasets/mbitai/secops-2k-trail-baseline.

sourceHugging Faceapache-2.0updated 20d agoView on Hugging Face

0likes57downloads

Dataset Card

SecOps-2k Trail baseline

Trail's parse of the SecOps-2k synthetic security logs, with the per-decision audit trail. Trail is a deterministic template miner: no model involved in these numbers. Each parsed line gets a template plus a receipt showing the exact decision that produced it.

Author: MbitAI. Parser code: TMFNK/LogParser-Trail. Archived release: doi:10.5281/zenodo.22484287. Companion paper: trail-techreport.pdf in the code repo.

What is inside

File	What
`data/trail_secops_parsed.parquet` (+ `.csv`)	Trail parse of SecOps-2k, 2,000 rows
`data/trail_secops_audit.jsonl`	one audit record per line, 2,000 records
`data/trail_sample.parquet` (+ `.csv`)	60-line sample parse, quick preview
`data/trail_sample_audit.jsonl`	60 audit records
`data/scores.json`	Trail scores plus the pinned Drain reference

Parsed columns (LogHub shape): LineId, Content, EventId, EventTemplate, ParameterList. Trail found 26 templates against 25 ground-truth ones. An audit record holds the line number, the cluster, whether the line matched or opened a new cluster, the similarity, and the template right after the decision.

Scores

Deterministic miner on SecOps-2k tight: GA 0.967, PA 0.967, FGA 0.8627, FTA 0.8627. The pinned Drain baseline on the same file (st=0.5, depth=4): GA 0.772, PA 0.6945, FGA 0.2947, FTA 0.2526. Drain compresses 25 truth templates into 70 parsed ones; Trail produces 26. The 60-line sample parses perfectly (all four scores 1.0, 8 templates) and is the CI golden in the code repo.

How it was made

./reproduce.sh in the Trail repo: builds the sample, parses it, writes the audit trail, scores against ground truth, then parses SecOps-2k (needs a LogParser-Dataset checkout next door) and checks the tight gate. Miner settings live in configs/miner.yaml (similarity 0.5, 2 anchor tokens, length slack 1). Metric code is an independent Apache-2.0 implementation of the LogHub-2.0 formulas, not a copy of the GPL evaluation script.

Privacy

Input logs are fully synthetic (see the secops-2k card). One caution that travels with the format: audit records quote source log content as examples, so auditing real logs would embed real content in the audit file. Here that content is invented, so the files are safe to share. Keep real-log audits in a private directory.

Limits

Header split is syntactic only. Token masks are a small pinned regex list, not a general field parser. Line order can change clusters; the committed sample keeps runs reproducible. Long lines with many variable tokens can fragment (sudo COMMAND lines, for example), and the fragmentation stays visible in the audit log. Local-model assist results are not included; they live in the code repo behind a local server and never change the deterministic parse.

Cite

bibtex

@software{mbitai_2026_logparser_trail,
  author  = {MbitAI},
  title   = {LogParser-Trail},
  year    = {2026},
  version = {v0.2.2},
  doi     = {10.5281/zenodo.22484287},
  url     = {https://doi.org/10.5281/zenodo.22484287},
}

If you score on SecOps-2k, also cite that dataset (doi:10.5281/zenodo.22341506). For the format and metrics: Jiang et al., ISSTA 2024 (arXiv:2308.10828); Zhu et al., ISSRE 2023 (arXiv:2008.06448). For the baseline: He et al., "Drain: An Online Log Parsing Approach with Fixed Depth Tree," ICWS 2017.