Abstract:The widespread adoption of cloud computing, edge, and IoT has increased the attack surface for cyber threats. This is due to the large-scale deployment of often unsecured, heterogeneous devices with varying hardware and software configurations. The diversity of these devices attracts a wide array of potential attack methods, making it challenging for individual organizations to have comprehensive knowledge of all possible threats. In this context, powerful anomaly detection models can be developed by combining data from different parties using Federated Learning. FL enables the collaborative development of ML-based IDSs without requiring the parties to disclose sensitive training data, such as network traffic or sensor readings. However, deploying the resulting models can be challenging, as they may require more computational resources than those available on target devices with limited capacity or already allocated for other operations. Training device-specific models is not feasible for an organization because a significant portion of the training data is private to other participants in the FL process. To address these challenges, this paper introduces INTELLECT, a novel solution that integrates feature selection, model pruning, and fine-tuning techniques into a cohesive pipeline for the dynamic adaptation of pre-trained ML models and configurations for IDSs. Through empirical evaluation, we analyze the benefits of INTELLECT's approach in tailoring ML models to the specific resource constraints of an organization's devices and measure variations in traffic classification accuracy resulting from feature selection, pruning, and fine-tuning operations. Additionally, we demonstrate the advantages of incorporating knowledge distillation techniques while fine-tuning, enabling the ML model to consistently adapt to local network patterns while preserving historical knowledge.

LOCALINTEL: Generating Organizational Threat Intelligence from Global and Local Cyber Knowledge

Actionable Cyber Threat Intelligence using Knowledge Graphs and Large Language Models

A System for Automated Open-Source Threat Intelligence Gathering and Management

Cyber-All-Intel: An AI for Security related Threat Intelligence

ThreatKG: An AI-Powered System for Automated Open-Source Cyber Threat Intelligence Gathering and Management

ThreatKG: A Threat Knowledge Graph for Automated Open-Source Cyber Threat Intelligence Gathering and Management

Cyber Knowledge Completion Using Large Language Models

TINKER: A framework for Open source Cyberthreat Intelligence

CTINEXUS: Leveraging Optimized LLM In-Context Learning for Constructing Cybersecurity Knowledge Graphs Under Data Scarcity

LLM-TIKG: Threat intelligence knowledge graph construction utilizing large language model

MALOnt: An Ontology for Malware Threat Intelligence

K-CTIAA: Automatic Analysis of Cyber Threat Intelligence Based on a Knowledge Graph

Cybersecurity Threat Hunting and Vulnerability Analysis Using a Neo4j Graph Database of Open Source Intelligence

KGV: Integrating Large Language Models with Knowledge Graphs for Cyber Threat Intelligence Credibility Assessment

Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)

INTELLECT: Adapting Cyber Threat Detection to Heterogeneous Computing Environments

Distributed Threat Intelligence at the Edge Devices: A Large Language Model-Driven Approach

CyberPal.AI: Empowering LLMs with Expert-Driven Cybersecurity Instructions

IntellBot: Retrieval Augmented LLM Chatbot for Cyber Threat Knowledge Delivery

RelExt: Relation Extraction using Deep Learning approaches for Cybersecurity Knowledge Graph Improvement

Open Source Intelligence for Malicious Behavior Discovery and Interpretation