1. A method comprising: receiving, by a computer, a training security log stream; extracting, by the computer, words contained within each line of the training security log stream; substituting, by the computer, a symbol for each of the extracted words to create a symbol string; scanning, by the computer, the symbol string to collect statistical data based on the symbol sequencing within the symbol string; generating, by the computer, frequency distribution data based on the statistical data collecting during the scanning; extracting, by the computer, tokens and the positional information corresponding to the tokens identified in the frequency distribution data, wherein the tokens are words, phrase or alphanumeric sequence represented by a symbol within training security log stream, determining, by the computer, if the identified token is either a variable token or a constant token by using the frequency distribution data, disregarding, by the computer, the variable tokens and their corresponding positional information, and storing, by the computer, the constant tokens and the corresponding positional information; replacing, by the computer, the substituted symbols with the extracted words they represent; identifying, by the computer, the tokens in the training security log stream based on the extracted positional information; scanning, by the computer, the identified tokens of the restored training security log stream to acquire scan data of the identified tokens; and storing, by the computer, in the database the identified tokens, positional information and the scan data for the identified tokens found in the training security log stream.
3. The method of claim 1 , wherein the extracting, by the computer, words contained within each line of the training security log stream, further comprises: identifying, by the computer, a boundary character between consecutive words in each line of the training security log stream; wherein the boundary character is a non-alpha-numeric character.