ML with Domain-Specific Ontology for IT Security Industry
summary
A pipeline for BSI-style IT security monitoring combines a curated ontology with machine learning: ontology relation vectors (one dimension per related entity) are compared to a document context vector by cosine similarity to resolve ambiguities like DOS ambiguity, producing NER/NEL annotations that bootstrap training data for models. The product TextVac yields ~90% F1 on common classes and ~70% F1 on malware/hacker-group classes. Bootstrapped training (parameter-efficient fine-tuning, LoRA/p-tuning) over XLM-Roberta adds generalization while LLM-generated synthetic examples reduce manual labeling.
AI-written summary · about
chapters (4)
related talks
25mUsing Large Language Models to Improve Data Loss Prevention in Organizations
23mSecurity and auditing tools in Large Language Models (LLM)
38mNext-Gen Detection: Harnessing LLMs for Sigma Rule Automation
32mAI/Machine Learning: What is Actually Working in Cybersecurity?
22mMachine Learning Based Attack Vector Modeling for CyberSecurity
30mData Driven Security
44mI Abuse Your LLM Live with 10 Security Vulnerabilities
26mDeath to the IOC: What's Next in Threat Intelligence