SecJev improves security decision models with expert training
SecJev: Bringing Security Expertise to System One Decision Models
Cryptography and SecurityComputation and Language
Summary
Security systems have to make smart decisions using lots of complicated information and rules. The authors built SecJev, a special kind of decision-making model trained specifically for security tasks, that works better than more general models with many more parameters. SecJev learns from many different types of security data and tasks, helping it make more accurate and reliable security decisions. The team also shared tools and data to help others build on their work.
What this means in practice
- •For security engineering teams: Improve automated security decision processes across diverse data types like network traffic and authentication logs using SecJev's specialized models.
- •For vehicle software developers: Integrate SecJev decision models to assess vehicle messages for security risks based on observed telemetry and policies.
Authors
Zheng Chen, Fei Yu, Haohao Huang, Yang Li, Anlong Chen, Lei Chen
Abstract
Security workflows need models that turn complex observations and explicit policies into decisions. System One models introduced by Jev return typed predictions and probabilities; security specialization supplies the domain expertise behind those predictions. We introduce SecJev, to our knowledge the first family of Jev-like decision models specialized for security, spanning 0.8B to 9B parameters. Built on Kev's single-pass candidate scorer, SecJev learns Boolean, choice, and ordered decisions from text, telemetry, and observation histories. We develop SecJev-Corpus to unify source-label prediction and explicit-policy evaluation across 14 tasks and eight sources. It covers tool outputs, traffic, federated updates, consensus, authentication, and vehicle messages. Scene-weighted training adapts the models across these domains while preserving a shared typed decision interface. Security specialization improves every model in the family; SecJev-0.8B outperforms general Kev-9B by 20.51 percentage points in task-macro accuracy. Comparisons with answer-only generative fine-tuning show close accuracy and latency with lower peak inference memory. Tests on new source groups reproduce gains over Kev in prompt-injection and traffic decisions, with capture-dependent false alarms. We release adapters, decision heads, SecJev-Corpus, and training and inference code.