System and method for using large language models to respond to information security incidents
An exemplary method for security monitoring and incident response using large language models comprises: receiving input data from elements of Security Operations Center (SOC), generating and sending a query based on the received input data to a Large Language Model (LLM), parsing a response received from the LLM, and performing analysis to determine whether a threat has been identified. In one aspect, the method further comprises: when a threat is identified, collecting artifacts of the threat, and analyzing the threat further with involvement of security professionals, when a threat is not identified, determining whether additional data is needed, and when additional data is needed, determining a type of the additional data, when the type of additional data that is determined, collecting additional information from elements of the SOC, and when additional data is not needed, terminating the incident response.
1 . A method for security monitoring and incident response by using large language models, the method comprising:
receiving input data from one or more elements of Security Operations Center (SOC);
generating a query based on the received input data and sending the generated query to a Large Language Model (LLM) that is trained on texts related to information security incidents and threat research;
receiving a response from the LLM and parsing the response received from the LLM; and
performing analysis of the response received from the LLM to determine whether a threat has been identified based on results of the received response from the LLM;
when the threat is identified, collecting artifacts of the threat using elements of the SOC, and analyzing the threat further within the SOC with involvement of security professionals;
when the threat is not identified:
determining whether additional data is needed for the LLM to identify the threat based on a presence of at least one of a list of certain phrases in the response received from the LLM; and
collecting the additional data from at least one of the elements of the SOC when the additional data is needed.
2 . The method of claim 1 , further comprising:
when additional data is needed, determining a type of the additional data that is needed;
when the type of additional data is determined, collecting additional data of that type at least from one of the elements of the SOC; and
when additional data is not needed for the LLM or when the type of additional data is not determined, terminating the security monitoring and incident response.
3 . The method of claim 1 , wherein the parsing of the response received from the LLM is performed using any number of natural language processing libraries.
4 . The method of claim 1 , wherein the parsing of the response received from the LLM is performed using a set of regular expressions to identify text elements.
5 . The method of claim 1 , wherein the element of the SOC is a Security Information and Event Management (SIEM).
6 . The method of claim 1 , wherein the element of the SOC is an Endpoint Detection and Response (EDR).
7 . The method of claim 1 , wherein the LLM is further trained by:
installing a malicious object and running a malicious routine on an endpoint device;
inputting a malware query associated with the endpoint device into the LLM to generate an output response, wherein the query has a necessary response indicative of the malicious routine and/or malicious object; and
training the LLM based on whether the output response is the necessary response.
8 . A system for security monitoring and incident response by using large language models, comprising:
at least one memory; and
at least one hardware processor coupled with the at least one memory and configured, individually or in combination, to:
receive input data from one or more elements of Security Operations Center (SOC);
generate a query based on the received input data and send the generated query to a Large Language Model (LLM) that is trained on texts related to information security incidents and threat research;
receive a response from the LLM and parse the response received from the LLM; and
perform analysis of the response received from the LLM to determine whether a threat has been identified based on results of the received response from the LLM;
when the threat is identified, collect artifacts of the threat using elements of the SOC, and analyzing the threat further within the SOC with involvement of security professionals;
when the threat is not identified:
determine whether additional data is needed for the LLM to identify the threat based on a presence of at least one of a list of certain phrases in the response received from the LLM; and
collect the additional data from at least one of the elements of the SOC when the additional data is needed.
9 . The system of claim 8 , the at least one hardware processor further configured to:
when additional data is needed, determine a type of the additional data that is needed;
when the type of additional data is determined, collect additional data of that type at least from one of the elements of the SOC; and
when additional data is not needed for the LLM or when the type of additional data is not determined, terminate the security monitoring and incident response.
10 . The system of claim 8 , wherein the parsing of the response received from the LLM is performed using any number of natural language processing libraries.
11 . The system of claim 8 , wherein the parsing of the response received from the LLM is performed using a set of regular expressions to identify text elements.
12 . The system of claim 8 , wherein the element of the SOC is a Security Information and Event Management (SIEM).
13 . The system of claim 8 , wherein the element of the SOC is an Endpoint Detection and Response (EDR).
14 . A non-transitory computer readable medium storing thereon computer executable instructions for security monitoring and incident response by using large language models, including instructions for:
receiving input data from one or more elements of Security Operations Center (SOC);
generating a query based on the received input data and sending the generated query to a Large Language Model (LLM) that is trained on texts related to information security incidents and threat research;
receiving a response from the LLM and parsing the response received from the LLM; and
performing analysis of the response received from the LLM to determine whether a threat has been identified based on results of the received response from the LLM;
when the threat is identified, collecting artifacts of the threat using elements of the SOC, and analyzing the threat further within the SOC with involvement of security professionals;
when the threat is not identified:
determining whether additional data is needed for the LLM to identify the threat based on a presence of at least one of a list of certain phrases in the response received from the LLM; and
collecting the additional data from at least one of the elements of the SOC when the additional data is needed.
15 . The non-transitory computer readable medium of claim 14 , the instructions for security monitoring and incident response by using large language models, further including instructions for:
when additional data is needed, determining a type of the additional data that is needed;
when the type of additional data is determined, collecting additional data of that type at least from one of the elements of the SOC; and
when additional data is not needed for the LLM or when the type of additional data is not determined, terminating the security monitoring and incident response.
16 . The non-transitory computer readable medium of claim 14 , wherein the parsing of the response received from the LLM is performed using any number of natural language processing libraries.
17 . The non-transitory computer readable medium of claim 14 , wherein the parsing of the response received from the LLM is performed using a set of regular expressions to identify text elements.
18 . The non-transitory computer readable medium of claim 14 , wherein the element of the SOC is a Security Information and Event Management (SIEM).