Abdullahi Arabo

Mapping Linux Auditd Telemetry to MITRE ATT&CK Techniques with a Locally Deployed Small Language Model: A Benchmark on the CAM-LDS Dataset

Mapping host activity to the MITRE ATT&CK framework usually needs manual work or a cloud-hosted large language model, which raises privacy and cost concerns for small organisations that cannot send their logs off-host. We ask whether a small language model (SLM), running locally and without fine-tuning, can classify Li...