Slide
Centre Interdisciplinaire
de Recherche et d’Innovation
en Cybersécurité et Société
de Recherche et d’Innovation
en Cybersécurité et Société
1.
Boudra, N.; Elhajjout, A.; Moudoud, H.; Oujaoura, M.; Jarir, Z.; Houda, Z. A. El
Toward Lightweight IoC Extraction in IoT: The Role of Small Language Models Proceedings Article
In: Int. Congr. Smart Agric. Sustain. Syst., SmartAgri SuSY, Institute of Electrical and Electronics Engineers Inc., 2025, ISBN: 979-833157801-5 (ISBN), (Journal Abbreviation: Int. Congr. Smart Agric. Sustain. Syst., SmartAgri SuSY).
Abstract | Links | BibTeX | Tags: Artificial intelligence, Cyber threats, Data-source, Edge Computing, extraction, Indicator of compromize, Indicators of Compromise, Information retrieval, Information Security, IoT Security, Language model, Malware, Natural languages, Network security, Program processors, Resource Constraint, Resource Constraints, Semantics, Small language model, Small Language Models, Threat Intelligence
@inproceedings{boudraLightweightIoCExtraction2025,
title = {Toward Lightweight IoC Extraction in IoT: The Role of Small Language Models},
author = {N. Boudra and A. Elhajjout and H. Moudoud and M. Oujaoura and Z. Jarir and Z. A. El Houda},
url = {https://www.scopus.com/pages/publications/105037622873?origin=resultslist},
doi = {10.1109/SmartAgriSuSY68475.2025.11466843},
isbn = {979-833157801-5 (ISBN)},
year = {2025},
date = {2025-01-01},
booktitle = {Int. Congr. Smart Agric. Sustain. Syst., SmartAgri SuSY},
publisher = {Institute of Electrical and Electronics Engineers Inc.},
abstract = {The proliferation of cyber threats necessitates rapid and accurate extraction of Indicators of Compromise (IoCs) from diverse security data sources. While Large Language Models (LLMs) have demonstrated exceptional capabilities in natural language processing and information extraction tasks, their deployment on resource-constrained IoT devices remains challenging due to computational and memory requirements. This paper investigates whether Small Language Models (SLMs) can serve as effective alternatives to LLMs for IoC extraction in IoT environments with limited resources. We present a novel direct LLM-based IoC extraction system leveraging context memory mechanisms for document-wide semantic understanding, specifically designed for deployment on edge computing infrastructure with consumer-grade hardware. Our experimental setup utilizes an RTX 4080 GPU and Ryzen 7 7700X processor running the Ollama framework with GPT-OSS:20B model to evaluate the feasibility of using smaller models instead of resource-intensive LLMs for security tasks. Evaluated on 9 diverse threat intelligence reports spanning different malware families and attack campaigns, the system achieved an average F1 score of 0.62, precision of 0.54, recall of 0.79, and accuracy of 0.85, demonstrating that SLMs can achieve acceptable accuracy levels for IoC extraction while operating within the computational constraints typical of IoT edge deployments. The results suggest that smaller models may provide viable alternatives to large language models for distributed threat intelligence processing in resource-limited environments. © 2025 IEEE.},
note = {Journal Abbreviation: Int. Congr. Smart Agric. Sustain. Syst., SmartAgri SuSY},
keywords = {Artificial intelligence, Cyber threats, Data-source, Edge Computing, extraction, Indicator of compromize, Indicators of Compromise, Information retrieval, Information Security, IoT Security, Language model, Malware, Natural languages, Network security, Program processors, Resource Constraint, Resource Constraints, Semantics, Small language model, Small Language Models, Threat Intelligence},
pubstate = {published},
tppubtype = {inproceedings}
}
The proliferation of cyber threats necessitates rapid and accurate extraction of Indicators of Compromise (IoCs) from diverse security data sources. While Large Language Models (LLMs) have demonstrated exceptional capabilities in natural language processing and information extraction tasks, their deployment on resource-constrained IoT devices remains challenging due to computational and memory requirements. This paper investigates whether Small Language Models (SLMs) can serve as effective alternatives to LLMs for IoC extraction in IoT environments with limited resources. We present a novel direct LLM-based IoC extraction system leveraging context memory mechanisms for document-wide semantic understanding, specifically designed for deployment on edge computing infrastructure with consumer-grade hardware. Our experimental setup utilizes an RTX 4080 GPU and Ryzen 7 7700X processor running the Ollama framework with GPT-OSS:20B model to evaluate the feasibility of using smaller models instead of resource-intensive LLMs for security tasks. Evaluated on 9 diverse threat intelligence reports spanning different malware families and attack campaigns, the system achieved an average F1 score of 0.62, precision of 0.54, recall of 0.79, and accuracy of 0.85, demonstrating that SLMs can achieve acceptable accuracy levels for IoC extraction while operating within the computational constraints typical of IoT edge deployments. The results suggest that smaller models may provide viable alternatives to large language models for distributed threat intelligence processing in resource-limited environments. © 2025 IEEE.
2.
Joudeh, I. O.; Cretu, A. -M.; Bouchard, S.; Guimond, S.
Prediction of Continuous Emotional Measures through Physiological and Visual Data † Journal Article
In: Sensors, vol. 23, no. 12, pp. 17–21, 2023, ISSN: 14248220, (Publisher: Interactive Media Institute).
Abstract | Links | BibTeX | Tags: Affect recognition, Affective state, Arousal, Data-source, Deep learning, Electrocardiography, emotion, Emotion Recognition, Emotions, face recognition, Faces detection, Forecasting, human, Humans, Images processing, Learning systems, Machine learning, Machine-learning, mental disease, Mental Disorders, Physiological data, physiology, Signal-processing, Statistical tests, Video recording, Virtual-reality environment
@article{joudeh_prediction_2023-1,
title = {Prediction of Continuous Emotional Measures through Physiological and Visual Data †},
author = {I. O. Joudeh and A. -M. Cretu and S. Bouchard and S. Guimond},
url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85163943735&doi=10.3390%2fs23125613&partnerID=40&md5=5e970f0d8c5790b85d8d77a9f3f52a2d},
doi = {10.3390/s23125613},
issn = {14248220},
year = {2023},
date = {2023-01-01},
journal = {Sensors},
volume = {23},
number = {12},
pages = {17–21},
publisher = {MDPI},
abstract = {The affective state of a person can be measured using arousal and valence values. In this article, we contribute to the prediction of arousal and valence values from various data sources. Our goal is to later use such predictive models to adaptively adjust virtual reality (VR) environments and help facilitate cognitive remediation exercises for users with mental health disorders, such as schizophrenia, while avoiding discouragement. Building on our previous work on physiological, electrodermal activity (EDA) and electrocardiogram (ECG) recordings, we propose improving preprocessing and adding novel feature selection and decision fusion processes. We use video recordings as an additional data source for predicting affective states. We implement an innovative solution based on a combination of machine learning models alongside a series of preprocessing steps. We test our approach on RECOLA, a publicly available dataset. The best results are obtained with a concordance correlation coefficient (CCC) of 0.996 for arousal and 0.998 for valence using physiological data. Related work in the literature reported lower CCCs on the same data modality; thus, our approach outperforms the state-of-the-art approaches for RECOLA. Our study underscores the potential of using advanced machine learning techniques with diverse data sources to enhance the personalization of VR environments. © 2023 by the authors.},
note = {Publisher: Interactive Media Institute},
keywords = {Affect recognition, Affective state, Arousal, Data-source, Deep learning, Electrocardiography, emotion, Emotion Recognition, Emotions, face recognition, Faces detection, Forecasting, human, Humans, Images processing, Learning systems, Machine learning, Machine-learning, mental disease, Mental Disorders, Physiological data, physiology, Signal-processing, Statistical tests, Video recording, Virtual-reality environment},
pubstate = {published},
tppubtype = {article}
}
The affective state of a person can be measured using arousal and valence values. In this article, we contribute to the prediction of arousal and valence values from various data sources. Our goal is to later use such predictive models to adaptively adjust virtual reality (VR) environments and help facilitate cognitive remediation exercises for users with mental health disorders, such as schizophrenia, while avoiding discouragement. Building on our previous work on physiological, electrodermal activity (EDA) and electrocardiogram (ECG) recordings, we propose improving preprocessing and adding novel feature selection and decision fusion processes. We use video recordings as an additional data source for predicting affective states. We implement an innovative solution based on a combination of machine learning models alongside a series of preprocessing steps. We test our approach on RECOLA, a publicly available dataset. The best results are obtained with a concordance correlation coefficient (CCC) of 0.996 for arousal and 0.998 for valence using physiological data. Related work in the literature reported lower CCCs on the same data modality; thus, our approach outperforms the state-of-the-art approaches for RECOLA. Our study underscores the potential of using advanced machine learning techniques with diverse data sources to enhance the personalization of VR environments. © 2023 by the authors.