Adaptive Schema Normalization for Deterministic Security Log Template Mining

DOI

https://www.doi.org/10.59256/indjcst.20260503022

Published In

Volume 5, Issue 3 (2026)

Published Online

September-December 2026

Pages

176-181

Article Type

Original Article

Check for updates

Modern Security Operations Centers (SOCs) process heterogeneous telemetry generated by security ap-pliances, cloud platforms, operating systems, applications, and network infrastructure. Rule-based parsers provide deterministic extraction but require repeated maintenance as formats evolve. Automated template-mining algorithms reduce this dependency through data-driven template discovery, yet commonly normalize field values while retain-ing vendor-specific field names. Equivalent events can therefore produce fragmented templates when schemas differ across products or change between software versions. This paper specifies an architecture that inserts adaptive schema normalization between value normalization and online template mining. The pipeline performs JSON envelope unwrapping, recursive flattening, deterministic value normalization, LLM-assisted canonical field mapping, schema-drift detection, Drain3 template mining, and versioned repository maintenance. Established canonical schemas such as OCSF can serve as the target schema, while the Adaptive Schema Normalization (ASN) mechanism automatically maps heterogeneous and previously unseen vendor fields into that target representation at ingestion time. Drain3 template mining and repository alias lookups remain deterministic; a field with no approved alias is instead grounded in its nearest existing canonical templates and passed to a large language model, which proposes a canonical mapping that an analyst must approve before the repository is updated. Drain3 consequently operates on canonical rather than vendor-specific schemas. The architecture is intended to reduce template fragmentation, improve cross-source interoperability, and preserve auditable, analyst-gated mapping decisions as telemetry schemas evolve