SYSTEM FOR MANAGING SECURITY RISKS WITH GENERATIVE ARTIFICIAL INTELLIGENCE
A system and method to use generative artificial intelligence to detect potential exfiltration events. A system for exfiltration analysis is configured to receive a plurality of file identifiers of a corresponding plurality of files, the plurality of files related to exfiltration alerts; store information about the plurality of files in a forensic file data store, the forensic file data store used to provide contextual information for a large language model (LLM); receive an exfiltration query from a user of the system; and produce a generative output using the LLM based on the exfiltration query and the contextual information.
1 . A system for exfiltration analysis, the system comprising:
a processor subsystem; and
memory including instructions, which when executed by the processor subsystem, cause the processor subsystem to:
receive a plurality of file identifiers of a corresponding plurality of files, the plurality of files related to exfiltration alerts;
store information about the plurality of files in a forensic file data store, the forensic file data store used to provide contextual information for a large language model (LLM);
receive an exfiltration query from a user of the system; and
produce a generative output using the LLM based on the exfiltration query and the contextual information.
2 . The system of claim 1 , wherein an exfiltration alert of the exfiltration alerts is based on at least one filesystem event.
3 . The system of claim 2 , wherein the at least one filesystem event includes an operation to create, read, modify, or delete a filesystem element.
4 . The system of claim 2 , wherein an exfiltration alert of the exfiltration alerts is based on an exfiltration model used to determine whether the at least one filesystem event is indicative of exfiltration.
5 . The system of claim 1 , wherein the LLM is a commercially available model fine-tuned using the contextual information.
6 . The system of claim 1 , wherein to produce the generative output, the processor subsystem is to:
vectorize the exfiltration query to produce a vector representation of the exfiltration query; and
perform a vector comparison of the vector representation of the exfiltration query and vector representations of the contextual information.
7 . The system of claim 6 , wherein the vector comparison is one of: a dot product operation, a cosine similarity operation, or a soft cosine similarity operation.
8 . The system of claim 1 , wherein the processor subsystem is to generate a risk score of an activity related to at least one of the exfiltration alerts.
9 . The system of claim 8 , wherein the processor subsystem is to initiate a mitigation function based on the risk score.
10 . The system of claim 9 , wherein to initiate the mitigation function, the processor subsystem is to alert a human administrator.
11 . The system of claim 9 , wherein to initiate the mitigation function, the processor subsystem is to transmit an educational video to a user related to the activity.
12 . The system of claim 9 , wherein to initiate the mitigation function, the processor subsystem is to restrict access to network resources for a user related to the activity.
13 . A method for exfiltration analysis, the method comprising:
receiving a plurality of file identifiers of a corresponding plurality of files, the plurality of files related to exfiltration alerts;
storing information about the plurality of files in a forensic file data store, the forensic file data store used to provide contextual information for a large language model (LLM);
receiving an exfiltration query from a user of the system; and
producing a generative output using the LLM based on the exfiltration query and the contextual information.
14 . The method of claim 13 , wherein an exfiltration alert of the exfiltration alerts is based on at least one filesystem event.
15 . The method of claim 14 , wherein the at least one filesystem event includes an operation to create, read, modify, or delete a filesystem element.
16 . The method of claim 14 , wherein an exfiltration alert of the exfiltration alerts is based on an exfiltration model used to determine whether the at least one filesystem event is indicative of exfiltration.
17 . The method of claim 13 , wherein the LLM is a commercially available model fine-tuned using the contextual information.
18 . The method of claim 13 , comprising generating a risk score of an activity related to at least one of the exfiltration alerts.
19 . The method of claim 18 , comprising initiating a mitigation function based on the risk score.
20 . A non-transitory machine-readable medium for exfiltration analysis, including instructions, which when executed by a machine, cause the machine to:
receive a plurality of file identifiers of a corresponding plurality of files, the plurality of files related to exfiltration alerts;
store information about the plurality of files in a forensic file data store, the forensic file data store used to provide contextual information for a large language model (LLM);
receive an exfiltration query from a user; and
produce a generative output using the LLM based on the exfiltration query and the contextual information.