MCM-Llama: A Fine-Tuned Large Language Model for Real-Time Threat Detection through Security Event Correlation

The correlation of security alerts is crucial for effective threat detection and mitigation in modern cybersecurity landscapes. With the exponential growth in the volume of generated alerts, there arises an imperative to continually develop new, efficient methods for alert correlation. The use of Large Language Models (LLMs) presents new avenues for enhancing real-time threat detection in the field of cybersecurity. In this paper, we introduce MCM-Llama, a fine-tuned language model aimed at improving security event correlation for real-time threat detection. Building upon our prior research, we augment the current framework by integrating MCM-Llama and introducing a novel architecture to practically implement our proposition. In doing so, we replace the correlation module previously based on Named Entity Recognition (NER) and semantic similarity with a fine-tuned Large Language Model (LLM). This transition allows us to capitalize on the advanced capabilities of LLM in comprehending and correlating security events dynamically. Through this enhancement, we aim to significantly improve the accuracy and efficiency of our threat detection system while leveraging the full potential of LLM technology in cybersecurity. Our experimental results validate the efficacy of the proposed approach by significantly improving the correlation rate, thereby reinforcing the pivotal role of Large Language Models (LLMs) in advancing security event correlation and threat detection methodologies.