Domain adapted language model improves cyber threat detection rules
Sigma-Hunter: A Domain-Specific Language Model for Threat Hunting and Detection Engineering
Artificial IntelligenceCryptography and Security
Summary
Cybersecurity experts write detailed rules to spot threats in computer logs, but creating these rules is tricky and error-prone. The authors made a special version of a language model called Sigma-Hunter that learns from thousands of good example rules to generate better, more accurate detection instructions. This model produces rules that are not just syntactically correct but also logically meaningful and focused, helping security teams find threats more effectively. It can run on local machines, which is useful in secure or offline environments.
What this means in practice
- •For cybersecurity detection engineers: Generate precise and well-aligned detection rules from threat reports to improve automated threat hunting accuracy locally.
- •For incident response teams: Create testable detection hypotheses quickly when analyzing forensic data without needing network access to hosted AI models.
- •For log management software developers: Integrate compact domain-tuned language models to help users author valid and effective detection rules within the product.$Commercial implications: Enables selling enhanced detection rule generation features embedded in security products to enterprise customers.
Authors
Kemal Davaslioglu, Sastry Kompella
Abstract
Detection engineers must translate threat reports, forensic observations, and hunt hypotheses into precise, testable rules. General-purpose large language models (LLMs) can draft such rules, but often produce invalid YAML, incorrect log sources, unsupported fields, or overly broad detection logic. This paper presents \emph{Sigma-Hunter}, a domain-adapted LLM for analyst-assistive Sigma rule generation and threat hunting. We build an instruction-tuning dataset from 3,635 validated open-source Sigma rules, expanded into 7,663 question-answer and analyst-reasoning examples. Each source rule is assigned to a single train, validation, or test partition before this expansion, so no rule leaks across splits. We fine-tune a 7B Mistral model and a Phi-4 model with LoRA and score held-out rule generations on syntax, approximate field consistency, and a semantic judgment of detection logic, completeness, selectivity, and log-source alignment. Sigma-Hunter-Mistral scores 8.17 overall, against 7.88 for the strongest general-purpose baseline and 4.61 for untuned Mistral. Two findings stand out: domain adaptation enables a compact 7B model to perform competitively with larger general-purpose models on this structured task, and syntactic validity is a weak proxy for semantic rule quality, as several baselines emit well-formed YAML carrying weak detection logic. The adapted models run locally, which suits detection engineering in disconnected environments where analysts cannot reach hosted model services.