BASTION

12 articles

LLM Hallucination Audit Implementation

// BASTION Technical Explanation2026-06-13LLM Hallucination Audit ImplementationCross-checking the numbers AI

Implementation Record: Balancing Accuracy and Determinism with Qwen2.5-14B + GPUStack

Explains why BASTION chose a local LLM (Qwen2.5-14B on GPUStack) over cloud LLM APIs. The LLM only handles tasks like log summaries and reports, while severity and blocking decisions are left to deterministic logic. Also covers enforced JSON output and low temperature.

Design based on the premise of “not trusting Agents” in a DMZ environment vulnerable to compromise

Explains BASTION's DMZ Agent design, which assumes the Agent itself may be compromised: AI-SLOG validation of Agent events against raw logs from a separate pathway, Agent permissions that exclude unblocking, heartbeat freeze and 24-hour automatic block expiration.

We built a system where AI automatically detects device types and starts monitoring just by pointing syslog to it

2026.04 / Tech Blog / BASTIONJust point syslog and AI automatically determines device type to start monitoring

A Story of AI Log Monitoring Detecting “Account Lockout Caused by a Hung PC”

2026.04 / Tech Blog / BASTION AI Log Monitoring Detected "Account Lock Caused by a Hung-up PC" BASTION's Windo

Building a System for Automated Infrastructure Log Analysis with Local LLM

2026.04 / Tech Blog / BASTION Building an Automated Infrastructure Log Analysis System with Local LLM AI autom

Mechanism of Multi-Layer Correlation Campaign Detection

How BASTION's multi-layer correlation campaign detection overlays multi-device detections per IP across five layers and time to reveal attack scenarios single-device logs miss. Covers the coherence function, deterministic, explainable threshold checks and subnet/ASN grouping.

BASTION

BASTION

LLM Hallucination Audit Implementation

Implementation Record: Balancing Accuracy and Determinism with Qwen2.5-14B + GPUStack

Design based on the premise of “not trusting Agents” in a DMZ environment vulnerable to compromise

We built a system where AI automatically detects device types and starts monitoring just by pointing syslog to it

A Story of AI Log Monitoring Detecting “Account Lockout Caused by a Hung PC”

Building a System for Automated Infrastructure Log Analysis with Local LLM

Mechanism of Multi-Layer Correlation Campaign Detection

The Story of Local LLM Fabricating Monitoring Report Numbers and Countermeasures

We built a mechanism to detect attacks invisible to individual systems through cross-system log correlation

Implementing an AI Active Firewall on a Web Server

Graduating from Slack Approval Gates to Fully Automated Blocking of Attack Source IPs

AI detects attack → Slack approval → automatic firewall block setup

Services

AI Solutions

Resources