DEVELOPMENT OF AN AI-ASSISTANT MODULE BASED ON QLoRA FINE-TUNING OF A LARGE LANGUAGE MODEL FOR AUTOMATED CYBERSECURITY INCIDENT ANALYSIS

Abstract

The article addresses the development and integration of an artificial-intelligence module for automated cybersecurity incident analysis within the decentralised Cybersecurity Dataspace (CSDS) platform for sharing cyber-incident data between organisations. The relevance of the study stems from systemic problems of modern security operations centres (SOCs): the excessive volume of security events, the global shortage of qualified specialists, the effect of alert fatigue, and the growing complexity of multi-stage attacks. The aim of the work is to build a specialised large language model (LLM) capable of classifying threats, assessing their severity, and providing structured response recommendations in line with the MITRE ATT&CK and NIST SP 800-61 methodologies. The paper provides a comparative analysis of four approaches to building AI assistants (zero-shot prompting, RAG, full fine-tuning, and parameter-efficient fine-tuning) and substantiates the choice of QLoRA as optimal for local deployment given confidentiality requirements and limited computational resources. A training dataset of 1,875 examples was assembled from five open sources (MITRE ATT&CK, NVD CVE, synthetic incident logs, open cybersecurity Q&A datasets, and Sigma/Elastic detection rules); it underwent deduplication, quality filtering, and verification of MITRE techniques. Two independent rounds of QLoRA fine-tuning of the Llama 3.2 3B Instruct base model were carried out with identical hyperparameters, and their results were described in terms of loss and token-level accuracy. A FastAPI microservice with REST endpoints for incident analysis, dialogue, batch processing, and monitoring was developed and integrated into the platform’s Next.js front end. Functional testing on three representative attack classes (SQL injection, ransomware, and brute force) and a comparative evaluation of answer quality using a keyword-overlap metric demonstrated a substantial quality improvement after fine-tuning compared with the base model. The proposed approach is reproducible on consumer-grade GPU hardware and can be scaled for industrial use. The article presents the problem statement, an analysis of current industrial and academic solutions, the theoretical basis of the method, the dataset-construction and fine-tuning methodology, the obtained results, and directions for further research.