First-year Ph.D. student in Computer and Cyber Sciences at Augusta University and U.S. Army Cyber officer.
Machine-Aware Local Language Models: Separating User Changes from Attacker Persistence on Linux
A new cron job, systemd service, or SSH key can be routine work by the machine's owner or an attacker making sure they can get back in. I am studying whether a local language model that knows the machine's history can tell the two apart and explain why.
- XAI for Intrusion Detection: Reading List: a curated, verified list of papers on explainable AI for intrusion detection.
- SIEM/IDS Detection Lab: undergraduate research at Georgia Southern University, validating Splunk and Snort detections against NIST SP 800-53.
Full CV, research details, and contact: samuelschwertfeger.github.io
Views expressed here are my own and do not represent the U.S. Army or the Department of Defense.



