الملخص
Detection engineers must translate threat reports, forensic observations, and hunt hypotheses into precise, testable rules. General-purpose large language models (LLMs) can draft such rules, but often produce invalid YAML, incorrect log sources, unsupported fields, or overly broad detection logic. This paper presents \emph{Sigma-Hunter}, a domain-adapted LLM for analyst-assistive Sigma rule generation and threat hunting. We build an instruction-tuning dataset from 3,635 validated open-source Sigma rules, expanded into 7,663 question-answer and analyst-reasoning examples. Each source rule is assigned to a single train, validation, or test partition before this expansion, so no rule leaks across splits. We fine-tune a 7B Mistral model and a Phi-4 model with LoRA and score held-out rule generations on syntax, approximate field consistency, and a semantic judgment of detection logic, completeness, selectivity, and log-source alignment. Sigma-Hunter-Mistral scores 8.17 overall, against 7.88 for the strongest general-purpose baseline and 4.61 for untuned Mistral. Two findings stand out: domain adaptation enables a compact 7B model to perform competitively with larger general-purpose models on this structured task, and syntactic validity is a weak proxy for semantic rule quality, as several baselines emit well-formed YAML carrying weak detection logic. The adapted models run locally, which suits detection engineering in disconnected environments where analysts cannot reach hosted model services.
الكلمات المفتاحية
الموضوع
بيانات النشر
- المجلة
- غير متاح
- وصول مفتوح
- وصول مفتوح أخضر
اقتبس هذه المقالة
APA 7
Davaslioglu, K., & Kompella, S. (2026). Sigma-Hunter: A Domain-Specific Language Model for Threat Hunting and Detection Engineering. https://omanscience.com/ar/articles/sigma-hunter-a-domain-specific-language-model-for-threat-hunting-and-detection-engineering
MLA 9
Davaslioglu, Kemal, and Sastry Kompella. "Sigma-Hunter: A Domain-Specific Language Model for Threat Hunting and Detection Engineering." https://omanscience.com/ar/articles/sigma-hunter-a-domain-specific-language-model-for-threat-hunting-and-detection-engineering.
شيكاغو (المؤلف–التاريخ)
Davaslioglu, Kemal, and Sastry Kompella. 2026. "Sigma-Hunter: A Domain-Specific Language Model for Threat Hunting and Detection Engineering." https://omanscience.com/ar/articles/sigma-hunter-a-domain-specific-language-model-for-threat-hunting-and-detection-engineering.
هارفارد
Davaslioglu, K. and Kompella, S. (2026) 'Sigma-Hunter: A Domain-Specific Language Model for Threat Hunting and Detection Engineering', Available at: https://omanscience.com/ar/articles/sigma-hunter-a-domain-specific-language-model-for-threat-hunting-and-detection-engineering.
فانكوفر
Davaslioglu K, Kompella S. Sigma-Hunter: A Domain-Specific Language Model for Threat Hunting and Detection Engineering. https://omanscience.com/ar/articles/sigma-hunter-a-domain-specific-language-model-for-threat-hunting-and-detection-engineering
IEEE
K. Davaslioglu, and S. Kompella, "Sigma-Hunter: A Domain-Specific Language Model for Threat Hunting and Detection Engineering," https://omanscience.com/ar/articles/sigma-hunter-a-domain-specific-language-model-for-threat-hunting-and-detection-engineering.