LLMBA: Efficient Behavior Analytics via Large Pretrained Models in Zero Trust Networks

Summary

The LLMBA framework uses a Large Language Model to analyze behavioral patterns of internal users and entities for Zero Trust Architecture. It applies a multi-level behavior encoding scheme, self-supervised fine-tuning to detect unknown malicious behaviors, and knowledge distillation to compress the model. On the CERT Insider Threat dataset, LLMBA outperforms state-of-the-art baselines in detection accuracy, and the compressed student model performs better than existing methods under comparable runtime constraints.