Matryoshka: automatically generating semantics-aware parsers for security logs with an LLM

The Matryoshka system uses an LLM to automatically generate semantics-aware structured parsers for security logs, without requiring labeled samples or manual intervention. The system infers syntax and variable naming directly from log samples and normalizes them to security-specific schemas such as OCSF, generating deterministic parsers and mapping rules that can be applied at data ingestion. Experiments show that it surpasses prior work on syntax parsing and, in side-by-side comparisons and retrieval of security-related queries, reaches a level comparable to manually written parsers.