7. A computer program product comprising: one or more non-transitory computer-readable storage media and program instructions stored on the one or more non-transitory computer-readable storage media, the program instructions comprising: program instructions to receive a training security log stream; program instructions to extract words contained within each line of the training security log stream; program instructions to substitute a symbol for each of the extracted words to create a symbol string; program instructions to scan the symbol string to collect statistical data based on the symbol sequencing within the symbol string; program instructions to generate frequency distribution data based on the statistical data collecting during the scanning; program instructions to extract tokens and the positional information corresponding to the tokens identified in the frequency distribution data, wherein the tokens are words, phrase or alphanumeric sequence represented by a symbol within training security log stream, determining if the identified token is either a variable token or a constant token by using the frequency distribution data, disregarding the variable tokens and their corresponding positional information, and storing the constant tokens and the corresponding positional information; program instructions to replace the substituted symbols with the extracted words they represent; program instructions to identify the tokens in the training security log stream based on the extracted positional information; program instructions to scan the identified tokens of the restored training security log stream to acquire scan data of the identified tokens; and program instructions to store in the database the identified tokens, positional information and the scan data for the identified tokens found in the training security log stream.
7. A computer program product comprising: one or more non-transitory computer-readable storage media and program instructions stored on the one or more non-transitory computer-readable storage media, the program instructions comprising: program instructions to receive a training security log stream; program instructions to extract words contained within each line of the training security log stream; program instructions to substitute a symbol for each of the extracted words to create a symbol string; program instructions to scan the symbol string to collect statistical data based on the symbol sequencing within the symbol string; program instructions to generate frequency distribution data based on the statistical data collecting during the scanning; program instructions to extract tokens and the positional information corresponding to the tokens identified in the frequency distribution data, wherein the tokens are words, phrase or alphanumeric sequence represented by a symbol within training security log stream, determining if the identified token is either a variable token or a constant token by using the frequency distribution data, disregarding the variable tokens and their corresponding positional information, and storing the constant tokens and the corresponding positional information; program instructions to replace the substituted symbols with the extracted words they represent; program instructions to identify the tokens in the training security log stream based on the extracted positional information; program instructions to scan the identified tokens of the restored training security log stream to acquire scan data of the identified tokens; and program instructions to store in the database the identified tokens, positional information and the scan data for the identified tokens found in the training security log stream. 8. The computer program of claim 7 , wherein the scanning the symbol string to collect statistical data based on the symbol sequencing within the symbol string, further comprises: wherein the scan is an n-gram scan that scans the each line starting at one end and advancing it way to the other end of the symbol string one symbol at a time; and wherein n is an integer that represents the number of symbols that are being scan at one time.