Finetuning Large Language Models (LLMs) for Security Log Detections
summary
Shows that an open-source LLM can be fine-tuned to label command-line obfuscation as yes/no using a small curated dataset, huggingface tokenizers and trainer, and llama 2 7B with 4-bit quantization so the 7B model drops from ~28GB to ~3.5GB of GPU memory. Uses synthetic and real command samples, template prompts with max_new_tokens=1, and LoRA parameter-efficient fine-tuning; fine-tuning runs in minutes–hours and improves binary detection but adds GPU cost and may be overkill for simple classifiers.
AI-written summary · about
chapters (17)
- 0:00Introduction and poll
- 1:46Who I am and agenda
- 2:08Traditional security log detections
- 3:38Command obfuscation detection
- 5:04Other detection techniques overview
- 6:06Logistic regression approach
- 8:12Deep learning for classification
- 9:36Why fine-tune LLMs
- 11:41Fine-tuning process overview
- 13:26Code walkthrough setup
- 16:20Testing model before fine-tuning
- 17:27Parameter efficient fine-tuning
- 19:10Advantages of fine-tuning
- 20:54Trade-offs of fine-tuning
- 22:19Applying to other use cases
- 23:24Closing thoughts and resources
- 23:44Q&A on AI in security
related talks
22mTraining a LLaMA in your Backyard: Fine-tuning Very Large...
31mEnhancing Secret Detection in Cybersecurity...
53mLLM Quality Optimization Bootcamp
21mFrom Data to Precision: Fine-Tuning LLMs for Proprietary Query Languages
29mLocal LLM fine-tuning: a practical example
39mThe Future is Fine-Tuned: Deploying Task-specific LLMs
46mUnder the Hood of LLMs — all those questions you never dared ask about them
29mLeveraging open-source LLMs for production