SynthLogAI: Generative AI for Synthetic Linux Log Generation and Evaluation

Problem and motivation

Kernel logs can contain operationally sensitive information, limiting sharing and reproducible experimentation. Synthetic logs must preserve event structure and useful behavior without simply memorizing or leaking properties of the original host traces.

Method and contribution

The paper starts from more than 57 million LTTng events collected on Ubuntu 20.04 and evaluates 1K, 10K, and 100K-event subsets with fields such as timestamp, elapsed time, host, event, CPU, process, and kernel details. CTGAN, LSTM, and GPT-2 are compared with prompt-based GPT-3.5, GPT-4.1 Mini, and o4 Mini systems; generated outputs are postprocessed and evaluated with Wasserstein distance, range/category completeness, Isolation Forest anomaly behavior, classifier utility, and nearest-neighbor privacy checks. The paper identifies an anonymous code repository at https://github.com/anonsubmit-code/SDG.

Findings and evidence

CTGAN provides the best overall fidelity/utility balance in the reported comparison. The paper reports downstream utility around 49.6–54.9% for selected settings and average privacy-distance values of 132.66 and 224.96 in its comparisons. LSTM/GPT-2 show scale drift as data size changes, while prompt-based LLMs exhibit structural and numeric inconsistencies despite stronger privacy signals; malformed outputs are reported below 0.5% after postprocessing in the evaluated settings.

Limitations and future directions

Limitations: The benchmark uses one Ubuntu/LTTng environment and does not establish preservation of causal or temporal relationships across diverse workloads. Prompt-only LLM generation has structural/numeric reliability issues, privacy-distance metrics are not a complete re-identification guarantee, and the study does not evaluate fine-tuning, concurrent trace channels, or operational deployment.

Future work: Use multi-host and multi-kernel corpora, preserve temporal/causal constraints explicitly, evaluate re-identification and membership inference, compare fine-tuned and constrained generators, and measure downstream utility on real trace-analysis tasks rather than aggregate similarity alone.

Resources

• Code

Sources and identifiers

• Published version published
• IEEE record public_source_record

When to cite this paper

Cite this paper when comparing synthetic Linux-log generators on fidelity, downstream utility, and privacy.

• The 57-million-event LTTng source and 1K/10K/100K evaluation subsets.
• CTGAN/LSTM/GPT-2 versus prompt-based LLM generation.
• Wasserstein, utility, anomaly, and privacy-distance evaluation.
• The CTGAN balance and prompt-LLM structural/numeric reliability trade-off.

Citation

@inproceedings{ezzatiJivan2025synthlogaigenerative,
  author = {Hridoy Rahman and Naser Ezzati-Jivan and Blessing Ogbuokiri},
  title = {SynthLogAI: Generative AI for Synthetic Linux Log Generation and Evaluation},
  year = {2025},
  booktitle = {2025 IEEE International Conference on Collaborative Advances in Software and COmputiNg (CASCON)},
  pages = {102-107},
  publisher = {IEEE},
  doi = {10.1109/CASCON66301.2025.00032},
  url = {https://doi.org/10.1109/CASCON66301.2025.00032}
}

Rahman, H., Ezzati-Jivan, N., & Ogbuokiri, B. (2025). SynthLogAI: Generative AI for Synthetic Linux Log Generation and Evaluation. In 2025 IEEE International Conference on Collaborative Advances in Software and COmputiNg (CASCON) (pp. 102-107). https://doi.org/10.1109/CASCON66301.2025.00032

H. Rahman, N. Ezzati-Jivan, and B. Ogbuokiri, "SynthLogAI: Generative AI for Synthetic Linux Log Generation and Evaluation," in 2025 IEEE International Conference on Collaborative Advances in Software and COmputiNg (CASCON), pp. 102-107, 2025, doi: 10.1109/CASCON66301.2025.00032