tareq052/cybersoc-gemma4-adapter

CyberSOC AI — Gemma 4 SOC Assistant

A LoRA fine-tuned adapter on Gemma 4 E4B for Security Operations Center (SOC) analysis. It explains security detection rules, interprets logs, and maps activity to MITRE ATT&CK techniques.

What it does

• —Explains Sigma detection rules
• —Interprets Windows Event Logs (EVTX) and Linux auditd events
• —Understands Wazuh alerts
• —Maps events to MITRE ATT&CK techniques
• —Produces structured SOC analyst assessments (Description, Severity, Log Source, MITRE tags)

Base Model

• —Base: google/gemma-4-E4B-it (~8B params)
• —Method: QLoRA (4-bit) fine-tuning
• —Trainable params: ~36.7M (0.46% of total)
• —LoRA rank: 16

Training Data

Fine-tuned on a combined cybersecurity dataset (~52,600 examples) covering Windows and Linux:

Total: ~52,609 training examples (the Linux portion was refined from a raw corpus of over 2 million log entries down to high-signal auditd events).

Training Setup

• —Hardware: Kaggle Tesla T4 x2
• —Framework: Unsloth + TRL (SFTTrainer)
• —Steps: 400 (max_steps)
• —Batch: 2 x grad_accum 4
• —Learning rate: 2e-4, linear scheduler
• —Optimizer: adamw_8bit
• —Final training loss: ~0.13

How to Use

from unsloth import FastModel

model, tokenizer = FastModel.from_pretrained(
    model_name = "tareq052/cybersoc-gemma4-adapter",
    max_seq_length = 1024,
    load_in_4bit = True,
)
FastModel.for_inference(model)

Limitations

• —The Linux auditd training data was template-generated and shallow, so the model is strong at formatting and parsing but may under-assess threat severity on Linux events. Windows detection performance is stronger due to more varied source data.
• —This is a research/learning project, not a production security tool. Always verify outputs with a human analyst.

License

Apache 2.0 (inherited from Gemma 4).