همایش بین المللی هوش مصنوعی

صفحه اصلی / دومین همایش بین المللی هوش مصنوعی

Federated LLM-Based SIEM with Meta-Model Aggregation: Enabling Collaborative, Scalable, and Privacy-Preserving Threat Detection

نویسندگان :

Masoud GanjKhani¹ Alireza Shameli-Sendi²

1- دانشگاه شهید بهشتی 2- دانشگاه شهید بهشتی

کلمات کلیدی :

Federated SIEM،LLM،MITRE ATT&CK،Privacy-Preserving Classification،Knowledge Sharing

چکیده :

The escalating sophistication of cyber threats necessitates a paradigm shift from traditional, isolated Security Information and Event Management (SIEM) systems toward intelligent, collaborative defense frameworks. This paper presents a novel Federated Large Language Model (LLM)-Based SIEM architecture that combines privacy-preserving federated learning principles with the advanced reasoning capabilities of LLMs for distributed network intrusion detection. Our approach enables multiple security nodes to collaboratively learn and improve detection accuracy by sharing abstracted attack patterns rather than sensitive raw traffic data, thereby ensuring strict privacy preservation. To provide structured threat intelligence and standardized attack taxonomy, all network intrusions are classified according to the MITRE ATT&CK framework, enabling alignment with industry-standard threat modeling and facilitating interoperability with existing security infrastructure. Experimental validation demonstrates that the proposed system achieves 79.4% overall accuracy with a 7.2% improvement across five federated learning cycles, successfully detecting 11 distinct attack categories mapped to MITRE ATT&CK techniques, including Reconnaissance (Port Scan - 97.1%), Resource Hijacking (DoS/DDoS), Credential Access (Brute Force - 100%), and Initial Access (SQL Injection, Phishing). The distributed architecture comprises three autonomous nodes sharing a centralized knowledge base that accumulates 98 validated detection rules through collaborative learning, with Brute Force attacks achieving perfect 100% detection accuracy. This work demonstrates that LLM-based federated learning can deliver competitive detection performance while maintaining data sovereignty and providing interpretable, MITRE-aligned threat intelligence for modern SIEM deployments.