ThreatQwen: Domain-Adaptive Fine-Tuning of a 1.7B LLM for Security Event Classification and SOC Triage

Every day, security teams in banks, hospitals, and government agencies face a flood of digital alarms. These alerts are triggered by automated systems that scan for suspicious patterns in computer logs, such as unusual file movements or strange network connections. While these systems are excellent at spotting potential threats, they cannot decide if an alert is a real danger or a harmless mistake. That final judgment, known as triage, has traditionally required a human analyst to read the raw data and reason through the situation. This manual process is slow and often overwhelmed by the sheer volume of alerts. In recent years, powerful artificial intelligence models have shown they can perform this kind of reasoning, but the organizations that need this help the most often cannot use them. Strict security rules and privacy laws prevent these teams from sending their sensitive logs to external servers where these large models live. They need a solution that can think like an expert but stay entirely within their own secure walls.

A new study introduces a solution called ThreatQwen, a small, specialized artificial intelligence model designed to run locally on standard computer hardware without needing an internet connection. The researcher took a compact language model, which is a type of software trained to understand and generate human language, and taught it specifically how to analyze security alerts. They fed the model a massive collection of real-world detection rules and synthetic examples of normal computer activity, teaching it to distinguish between genuine threats and harmless events. The result is a tool that can sit on a single computer in a secure office, read an alert, and immediately tell a human operator whether it is malicious or benign. This approach allows highly regulated organizations to use advanced artificial intelligence reasoning without ever exposing their private data to the outside world.

The core challenge the researcher addressed was that most existing artificial intelligence models are too large to run on local machines and are not trained on the specific language of security logs. To solve this, the team built a training dataset by combining thousands of real detection rules from open-source projects with thousands of new examples of normal computer behavior. They used a powerful external artificial intelligence to generate these normal examples, ensuring the model saw a balanced mix of dangerous and safe events. This was crucial because the original data was heavily skewed toward threats; without the added examples of normal activity, the model would have learned to simply label everything as dangerous. By carefully balancing the training data and removing certain fields that acted as easy shortcuts, the researcher forced the model to actually learn the patterns of the events rather than guessing based on superficial clues.

The model was then fine-tuned using a technique that allows it to learn new tasks without needing to be completely rebuilt, a process that took only a few hours on a standard graphics card. When tested on a set of 882 examples, split evenly between real threats and normal events, the new model achieved an accuracy of 95.1 percent. It correctly identified 96.1 percent of the actual threats and 94.2 percent of the normal events. In a direct comparison, this small, locally running model significantly outperformed two of the world's most advanced, cloud-based artificial intelligence systems, which scored below 52 percent accuracy on the same tasks. The cloud models tended to guess that almost everything was a threat, failing to recognize normal activity, while the new model learned the subtle differences that matter to security experts.

What makes this development particularly significant is its practicality for real-world security operations. The entire model, including its specialized training, fits into just 3.1 gigabytes of computer memory, which is small enough to run on a single consumer-grade graphics card found in many offices. It requires no network connection, meaning it can be deployed in air-gapped environments where computers are physically isolated from the internet for security reasons. This allows banks, defense contractors, and intelligence agencies to automate the initial review of millions of alerts without violating data privacy regulations. The researcher also noted that running this model locally is vastly cheaper than paying for cloud-based services, costing less than two dollars a day for high-volume processing compared to nearly twenty dollars for the same work on a cloud platform.

The study does have limitations that the author openly acknowledges. The training data and the test examples for normal behavior were generated by computers rather than taken directly from live, real-world networks. While the detection rules were based on actual attacker techniques observed in the wild, the model has not yet been tested on the complex, messy data streams of a live security center. The researcher states that the next critical step is to validate the model against real-world telemetry to ensure it generalizes well beyond the synthetic examples used in the study. Additionally, the model currently understands only English, leaving out non-English threat intelligence sources. Despite these caveats, the work demonstrates that a small, open-source model, when carefully trained on the right data, can perform specialized security tasks better than massive, general-purpose systems, offering a viable path for secure, local artificial intelligence in critical infrastructure.