Docker systems are gaining widespread use due to their consistency, scalability, and ease of application portability, which addresses specific security challenges. Traditional monitoring and intrusion detection systems based on predefined rules often struggle with advanced attack patterns due to a lack of the capability to correlate incoming log messages. This paper proposes a correlation-aware log analysis approach based on a Mixture-of-Experts (MoE) large language models, enabling detection of malicious activity by analyzing both individual log entries and their contextual relationships within sequences of logs. The system processes each log in the context of 50 preceding messages, allowing identification of attack patterns that are not observable from isolated logs. To evaluate the approach, we generated a comprehensive dataset based on OWASP Top 10 attack scenarios, enriched with zero-day attacks such as Log4j and React2Shell, deployed in a distributed Docker Swarm environment. Multiple LLMs were evaluated under identical hardware conditions to ensure fair comparison. Experimental results demonstrate that while most models achieve comparable performance on single-log detection, significant differences emerge in contextual analysis. The proposed MoE-based approach demonstrates superior effectiveness, achieving an F1 score from 0.993 to 0.998 for contextual-log analysis. The contribution of this research is the novel use of MoE LLMs for log analysis, the distinct novel attack log dataset, and the unique framework based on offline technology that conserves hardware resources and data privacy.

The research in the area of malware analysis is very popular, with an accent on machine learning algorithms that help automate this subject. One of the leading portals that help researchers with dataset problems is VirusTotal, providing free academic accounts with hundreds of thousands of malware samples with metadata. This work contributes with the analysis of 429,058 malware samples from VirusTotal in terms of overcoming the problem of inconsistent labeling of the antivirus scan results from different vendors. Two methods were used, LSA and LDA, both with automatic calibration of parameters, with the purpose of finding the optimal number of clusters - both resulting in 5. The graphical representation of the clusters was done by k-means clustering in two-dimensional space. Additional research on the most informative words in each cluster showed that 4 similar clusters could be reported as a result from both methods and one cluster per method (LSA and LDA) that was not related to the cluster in the opposite method. The showed results prove that the clustering approach to malware data analysis with automatic calibration of the parameters is a good method when dealing with inconsistent labels in the dataset.