Search papers, labs, and topics across Lattice.
This study introduces a novel multi-source cybersecurity log dataset that integrates system, network, and browser activity, labeled with ATT&CK technique granularity, addressing the limitations of existing datasets. By generating realistic attack scenarios using real tools, the dataset comprises 870 sessions, including 70 attack and 800 benign instances, with approximately 2.3 million events. Fine-tuning three Small Language Models (SLMs) using Low-Rank Adaptation (LoRA) demonstrated significant improvements in chunk classification accuracy, achieving between 90% and 97%, while technique identification showed promising partial-match scores despite a maximum exact-match accuracy of 42%.
Fine-tuning Small Language Models on a comprehensive multi-source cybersecurity log dataset resulted in a dramatic leap in classification accuracy, highlighting the potential of cross-source data for enhanced threat detection.
Multi-stage cyberattacks span system, network, and browser logs. Detecting them requires correlating events across all three sources. Machine learning methods can learn these cross-source patterns, but they need labeled multi-source data. Existing public datasets fall short. Network-only datasets such as CICIDS and UNSW-NB15 miss host and browser activity. Host-focused datasets such as LMDG and CICAPT-IIoT lack browser telemetry. ATLAS includes all three sources but labels events only as malicious or benign, without MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) technique granularity. No public dataset combines all three sources with per-entry ATT&CK technique labels. We close the gap by building a multi-source log dataset of 870 sessions (70 attack, 800 benign) and approximately 2.3 million events. We captured system, network, and browser activity simultaneously on Windows endpoints. We labeled malicious events with ATT&CK technique IDs, covering 12 tactics and 53 techniques. We generated all attack data using real tools, including Remote Access Trojan (RAT), Command and Control (C2) tunnels, and cloud exfiltration. To demonstrate learnability, we fine-tuned three Small Language Models (SLMs) (Qwen2.5-1.5B, Llama-3.2-3B, Phi-4-Mini) using Low-Rank Adaptation (LoRA). We compared each against its base variant across ten metrics on two tasks: chunk classification and ATT&CK technique identification. Fine-tuning improved every model on every metric. Chunk classification accuracy rose from approximately 8% in the base variants to between 90% and 97% after fine-tuning. Technique identification remained challenging, with the best exact-match accuracy at 42%, although high partial-match scores show the models captured most of the underlying reasoning.
