A review of intelligent denoising methods for multi-source security logs in industrial cybersecurity operations

Purpose This review examines intelligent denoising methods for multi-source security logs in industrial cybersecurity operations. It focuses on discrete logs, audit events and security alerts ingested into log management platforms. The study aims to analyse how to reduce the burden of log and alert processing while preserving critical security evidence, anomalous information and event correlations, and to identify the applicability boundaries and research gaps of existing methods. Design/methodology/approach This study constructs a two-tier evidence scope and employs systematic mapping and narrative synthesis to synthesise 64 verified publications. It further compares the capabilities, deployment conditions and applicability of different technical approaches. Findings Existing approaches have expanded from sequence prediction and semantic representation to include parsing assisted by large language models knowledge augmentation, and collaboration between lightweight models and LLMs. The evidence reviewed suggests that lightweight models are generally better suited to low-latency preliminary screening, whereas LLMs are used primarily for semantically ambiguous and context-intensive tasks. Selective routing provides one means of coordinating the two model types while controlling the frequency and cost of large language model invocation. Originality/value This study reviews and compares existing research by focussing on semantic representation, knowledge augmentation, the division of responsibilities between lightweight models and large language models, and selective routing. It clarifies the functional boundaries and applicable conditions of different methods.