Slide
Centre Interdisciplinaire
de Recherche et d’Innovation
en Cybersécurité et Société
de Recherche et d’Innovation
en Cybersécurité et Société
1.
Boudra, N.; Elhajjout, A.; Moudoud, H.; Oujaoura, M.; Jarir, Z.; Houda, Z. A. El
Toward Lightweight IoC Extraction in IoT: The Role of Small Language Models Proceedings Article
In: Int. Congr. Smart Agric. Sustain. Syst., SmartAgri SuSY, Institute of Electrical and Electronics Engineers Inc., 2025, ISBN: 979-833157801-5 (ISBN), (Journal Abbreviation: Int. Congr. Smart Agric. Sustain. Syst., SmartAgri SuSY).
Abstract | Links | BibTeX | Tags: Artificial intelligence, Cyber threats, Data-source, Edge Computing, extraction, Indicator of compromize, Indicators of Compromise, Information retrieval, Information Security, IoT Security, Language model, Malware, Natural languages, Network security, Program processors, Resource Constraint, Resource Constraints, Semantics, Small language model, Small Language Models, Threat Intelligence
@inproceedings{boudraLightweightIoCExtraction2025,
title = {Toward Lightweight IoC Extraction in IoT: The Role of Small Language Models},
author = {N. Boudra and A. Elhajjout and H. Moudoud and M. Oujaoura and Z. Jarir and Z. A. El Houda},
url = {https://www.scopus.com/pages/publications/105037622873?origin=resultslist},
doi = {10.1109/SmartAgriSuSY68475.2025.11466843},
isbn = {979-833157801-5 (ISBN)},
year = {2025},
date = {2025-01-01},
booktitle = {Int. Congr. Smart Agric. Sustain. Syst., SmartAgri SuSY},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {The proliferation of cyber threats necessitates rapid and accurate extraction of Indicators of Compromise (IoCs) from diverse security data sources. While Large Language Models (LLMs) have demonstrated exceptional capabilities in natural language processing and information extraction tasks, their deployment on resource-constrained IoT devices remains challenging due to computational and memory requirements. This paper investigates whether Small Language Models (SLMs) can serve as effective alternatives to LLMs for IoC extraction in IoT environments with limited resources. We present a novel direct LLM-based IoC extraction system leveraging context memory mechanisms for document-wide semantic understanding, specifically designed for deployment on edge computing infrastructure with consumer-grade hardware. Our experimental setup utilizes an RTX 4080 GPU and Ryzen 7 7700X processor running the Ollama framework with GPT-OSS:20B model to evaluate the feasibility of using smaller models instead of resource-intensive LLMs for security tasks. Evaluated on 9 diverse threat intelligence reports spanning different malware families and attack campaigns, the system achieved an average F1 score of 0.62, precision of 0.54, recall of 0.79, and accuracy of 0.85, demonstrating that SLMs can achieve acceptable accuracy levels for IoC extraction while operating within the computational constraints typical of IoT edge deployments. The results suggest that smaller models may provide viable alternatives to large language models for distributed threat intelligence processing in resource-limited environments. © 2025 IEEE.},
note = {Journal Abbreviation: Int. Congr. Smart Agric. Sustain. Syst., SmartAgri SuSY},
keywords = {Artificial intelligence, Cyber threats, Data-source, Edge Computing, extraction, Indicator of compromize, Indicators of Compromise, Information retrieval, Information Security, IoT Security, Language model, Malware, Natural languages, Network security, Program processors, Resource Constraint, Resource Constraints, Semantics, Small language model, Small Language Models, Threat Intelligence},
pubstate = {published},
tppubtype = {inproceedings}
}
The proliferation of cyber threats necessitates rapid and accurate extraction of Indicators of Compromise (IoCs) from diverse security data sources. While Large Language Models (LLMs) have demonstrated exceptional capabilities in natural language processing and information extraction tasks, their deployment on resource-constrained IoT devices remains challenging due to computational and memory requirements. This paper investigates whether Small Language Models (SLMs) can serve as effective alternatives to LLMs for IoC extraction in IoT environments with limited resources. We present a novel direct LLM-based IoC extraction system leveraging context memory mechanisms for document-wide semantic understanding, specifically designed for deployment on edge computing infrastructure with consumer-grade hardware. Our experimental setup utilizes an RTX 4080 GPU and Ryzen 7 7700X processor running the Ollama framework with GPT-OSS:20B model to evaluate the feasibility of using smaller models instead of resource-intensive LLMs for security tasks. Evaluated on 9 diverse threat intelligence reports spanning different malware families and attack campaigns, the system achieved an average F1 score of 0.62, precision of 0.54, recall of 0.79, and accuracy of 0.85, demonstrating that SLMs can achieve acceptable accuracy levels for IoC extraction while operating within the computational constraints typical of IoT edge deployments. The results suggest that smaller models may provide viable alternatives to large language models for distributed threat intelligence processing in resource-limited environments. © 2025 IEEE.
2.
Gagnon, S.; Azzi, S.
Semantic Annotation of Parliamentary Debates and Legislative Intelligence Enhancing Citizen Experience Journal Article
In: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 13429 LNCS, pp. 63–76, 2022, ISSN: 03029743, (ISBN: 9783031126727).
Abstract | Links | BibTeX | Tags: Analytic tools, Core functionality, Digital solutions, Knowledge graph, Language processing, Laws and legislation, Legislative intelligence, Natural language processing systems, Natural languages, Parliamentary debate, Parliamentary proceedings, Semantic annotations, Semantic-analytics, Semantics
@article{gagnon_semantic_2022,
title = {Semantic Annotation of Parliamentary Debates and Legislative Intelligence Enhancing Citizen Experience},
author = {S. Gagnon and S. Azzi},
editor = {Kotsis G. Francesconi E. Ko A.},
url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85135782631&doi=10.1007%2f978-3-031-12673-4_5&partnerID=40&md5=0765bacc7d38f77896bd9adf402268b9},
doi = {10.1007/978-3-031-12673-4_5},
issn = {03029743},
year = {2022},
date = {2022-01-01},
journal = {Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)},
volume = {13429 LNCS},
pages = {63–76},
publisher = {Springer Science and Business Media Deutschland GmbH},
abstract = {The concept of “Legislative Intelligence” (LegisIntel) refers to Artificial Intelligence (AI) and semantic analytics tools implemented in parliaments to enhance citizen experience in monitoring complex interrelations among various contents of parliamentary proceedings. The integration of a suite of digital solutions can build upon the core functionality of Semantic Annotation of Parliamentary Debates. Using well-established Natural Language Processing (NLP) technologies, linked to ontologies and Knowledge Graphs (KG), it can help identify the concepts and entities throughout texts, and index sentences and summaries as per a citizen’s customized knowledge base. These annotations can then be leveraged to recommend relevant text excerpts end-users could build upon, within teams if they chose to do so, and possibly compose and customize legislative critiques and recommendations thoroughly tested for coherence, accuracy, and evidence. The present study proposes an international open-source initiative among parliaments to ensure the launch and viability of a suite of LegisIntel solutions. It reports on the completed initial phase of this initiative, aiming to prepare discussions in launching an international consultation among peers. The goals of this phase are to document the core functionality of LegisIntel solutions and formulate a proposed architecture that may serve to generate ideas from various developer communities. The Action Design Research (ADR) methodology is used in this process, with results focused on system artefacts such as an interface mockup, a functional design, and a model of infrastructure components. The conclusion addresses risks and outlines the next steps of this initiative. © 2022, The Author(s), under exclusive license to Springer Nature Switzerland AG.},
note = {ISBN: 9783031126727},
keywords = {Analytic tools, Core functionality, Digital solutions, Knowledge graph, Language processing, Laws and legislation, Legislative intelligence, Natural language processing systems, Natural languages, Parliamentary debate, Parliamentary proceedings, Semantic annotations, Semantic-analytics, Semantics},
pubstate = {published},
tppubtype = {article}
}
The concept of “Legislative Intelligence” (LegisIntel) refers to Artificial Intelligence (AI) and semantic analytics tools implemented in parliaments to enhance citizen experience in monitoring complex interrelations among various contents of parliamentary proceedings. The integration of a suite of digital solutions can build upon the core functionality of Semantic Annotation of Parliamentary Debates. Using well-established Natural Language Processing (NLP) technologies, linked to ontologies and Knowledge Graphs (KG), it can help identify the concepts and entities throughout texts, and index sentences and summaries as per a citizen’s customized knowledge base. These annotations can then be leveraged to recommend relevant text excerpts end-users could build upon, within teams if they chose to do so, and possibly compose and customize legislative critiques and recommendations thoroughly tested for coherence, accuracy, and evidence. The present study proposes an international open-source initiative among parliaments to ensure the launch and viability of a suite of LegisIntel solutions. It reports on the completed initial phase of this initiative, aiming to prepare discussions in launching an international consultation among peers. The goals of this phase are to document the core functionality of LegisIntel solutions and formulate a proposed architecture that may serve to generate ideas from various developer communities. The Action Design Research (ADR) methodology is used in this process, with results focused on system artefacts such as an interface mockup, a functional design, and a model of infrastructure components. The conclusion addresses risks and outlines the next steps of this initiative. © 2022, The Author(s), under exclusive license to Springer Nature Switzerland AG.