tareq052/cybersoc-gemma4-adapter

CyberSOC AI — Gemma 4 SOC Assistant

A LoRA fine-tuned adapter on Gemma 4 E4B for Security Operations Center (SOC) analysis. It explains security detection rules, interprets logs, and maps activity to MITRE ATT&CK techniques.

What it does

• Explains Sigma detection rules
• Interprets Windows Event Logs (EVTX) and Linux auditd events
• Understands Wazuh alerts
• Maps events to MITRE ATT&CK techniques
• Produces structured SOC analyst assessments (Description, Severity, Log Source, MITRE tags)

Base Model

• Base: google/gemma-4-E4B-it (~8B params)
• Method: QLoRA (4-bit) fine-tuning
• Trainable params: ~36.7M (0.46% of total)
• LoRA rank: 16

Training Data

Fine-tuned on a combined cybersecurity dataset (~52,600 examples) covering Windows and Linux:

Source	Examples	Description
Windows chat	11,194	Detection rules + MITRE mapping
Linux auditd (refined)	15,000	Syscall / audit event analysis
Sigma rules	3,569	Sigma detection logic
Final train	11,194	General SOC instruction data
EVTX dataset	4,386	Windows event analysis
Atomic	5,553	Atomic Red Team techniques
Wazuh	1,713	Wazuh alert interpretation

Total: ~52,609 training examples (the Linux portion was refined from a raw corpus of over 2 million log entries down to high-signal auditd events).

Training Setup

• Hardware: Kaggle Tesla T4 x2
• Framework: Unsloth + TRL (SFTTrainer)
• Steps: 400 (max_steps)
• Batch: 2 x grad_accum 4
• Learning rate: 2e-4, linear scheduler
• Optimizer: adamw_8bit
• Final training loss: ~0.13

How to Use

from unsloth import FastModel

model, tokenizer = FastModel.from_pretrained(
    model_name = "tareq052/cybersoc-gemma4-adapter",
    max_seq_length = 1024,
    load_in_4bit = True,
)
FastModel.for_inference(model)

Limitations

• The Linux auditd training data was template-generated and shallow, so the model is strong at formatting and parsing but may under-assess threat severity on Linux events. Windows detection performance is stronger due to more varied source data.
• This is a research/learning project, not a production security tool. Always verify outputs with a human analyst.

License

Apache 2.0 (inherited from Gemma 4).