MCM-Llama: A Fine-Tuned Large Language Model for Real-Time Threat Detection through Security Event Correlation
Bibliographic record
Abstract
The correlation of security alerts is crucial for effective threat detection and mitigation in modern cybersecurity landscapes. With the exponential growth in the volume of generated alerts, there arises an imperative to continually develop new, efficient methods for alert correlation. The use of Large Language Models (LLMs) presents new avenues for enhancing real-time threat detection in the field of cybersecurity. In this paper, we introduce MCM-Llama, a fine-tuned language model aimed at improving security event correlation for real-time threat detection. Building upon our prior research, we augment the current framework by integrating MCM-Llama and introducing a novel architecture to practically implement our proposition. In doing so, we replace the correlation module previously based on Named Entity Recognition (NER) and semantic similarity with a fine-tuned Large Language Model (LLM). This transition allows us to capitalize on the advanced capabilities of LLM in comprehending and correlating security events dynamically. Through this enhancement, we aim to significantly improve the accuracy and efficiency of our threat detection system while leveraging the full potential of LLM technology in cybersecurity. Our experimental results validate the efficacy of the proposed approach by significantly improving the correlation rate, thereby reinforcing the pivotal role of Large Language Models (LLMs) in advancing security event correlation and threat detection methodologies.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame distilled prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. Learned from the 10,348 direct Codex labels and 10,348 direct Gemma labels. Candidate is the union of thresholded teacher heads; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels or direct frontier model labels.
Codex and Gemma teacher scores by category
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.000 | 0.000 |
| Meta-epidemiology (narrow) | 0.000 | 0.000 |
| Meta-epidemiology (broad) | 0.000 | 0.000 |
| Bibliometrics | 0.000 | 0.000 |
| Science and technology studies | 0.000 | 0.000 |
| Scholarly communication | 0.000 | 0.001 |
| Open science | 0.000 | 0.000 |
| Research integrity | 0.000 | 0.000 |
| Insufficient payload (model declined to judge) | 0.000 | 0.000 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one teacher head, not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".