Systems and methods for utilizing large language models (LLMs) for improving machine learning models in network and computer security
Systems and methods for utilizing Large Language Models (LLMs) for improving machine learning models in network and computer security include obtaining tabular data related to an aspect of networking and computer security; converting the tabular data to natural language for each row in the tabular data; inputting the natural language for each row in the tabular data into a Large Language Model (LLM); obtaining an output from the LLM for each row in the tabular data with embedded data therewith; and utilizing the output to train a machine learning model related to the aspect of networking and computer security.
1 . A method comprising steps of:
obtaining tabular data related to an aspect of networking and computer security;
converting the tabular data to natural language for each row in the tabular data, wherein converting includes serializing, for each row, feature names and corresponding feature values into a natural language string that preserves relationships among the feature names and feature values within the row;
inputting the natural language for each row in the tabular data into a Large Language Model (LLM);
obtaining an output from the LLM for each row in the tabular data with embedded data therewith; and
utilizing the output to train a machine learning model related to the aspect of networking and computer security,
wherein the embedded data includes, for each row, an embedding vector generated by the LLM from the natural language string for that row to train the machine learning model, the embedding vector capturing relationships between elements within each row of the tabular data, and wherein utilizing the output to train the machine learning model includes using the embedding vector as an input feature for training the machine learning model or for initializing a knowledge graph used to train the machine learning model.
2 . The method of claim 1 , wherein the tabular data is obtained from a cloud-based system, and wherein the tabular data includes data collected based on inline monitoring of users, the Internet, and cloud services.
3 . The method of claim 1 , wherein the aspect of networking and computer security includes application segmentation, wherein the tabular data relates to users, data associated with the users, and application permissions for the users.
4 . The method of claim 1 , wherein the aspect of networking and computer security includes application segmentation, wherein the tabular data relates to users, identification information for the users, and server ports for applications are used by the users, and
wherein the machine learning model is trained to determine which of the applications a new user should have access permissions.
5 . The method of claim 1 , wherein the aspect of networking and computer security includes classifications, wherein the tabular data relates to transactions and associated classifications.
6 . The method of claim 5 , wherein the classifications are for content of an associated Uniform Resource Location (URL).
7 . The method of claim 1 , wherein the relationships are drawn between a plurality of internet ports by, for each of the plurality of Internet ports represented in the tabular data:
submitting to the LLM a token sequence identifying the internet port;
obtaining from the LLM an embedding vector that encodes relationships for the internet port; and
grouping the internet ports whose embedding vectors satisfy a similarity threshold, thereby forming port-clusters used for network-security policy enforcement.
8 . The method of claim 1 , wherein embedding vectors are used to initialize a knowledge graph that encodes user-app transactions, the initialization with the embedding vectors yielding lower initial training loss and faster convergence.
9 . A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:
obtaining tabular data related to an aspect of networking and computer security;
converting the tabular data to natural language for each row in the tabular data, wherein converting includes serializing, for each row, feature names and corresponding feature values into a natural language string that preserves relationships among the feature names and feature values within the row;
inputting the natural language for each row in the tabular data into a Large Language Model (LLM);
obtaining an output from the LLM for each row in the tabular data with embedded data therewith; and
utilizing the output to train a machine learning model related to the aspect of networking and computer security,
wherein the embedded data includes, for each row, an embedding vector generated by the LLM from the natural language string for that row to train the machine learning model, the embedding vector capturing relationships between elements within each row of the tabular data, and wherein utilizing the output to train the machine learning model includes using the embedding vector as an input feature for training the machine learning model or for initializing a knowledge graph used to train the machine learning model.
10 . The non-transitory computer-readable medium of claim 9 , wherein the tabular data is obtained from a cloud-based system, and wherein the tabular data includes data collected based on inline monitoring of users, the Internet, and cloud services.
11 . The non-transitory computer-readable medium of claim 9 , wherein the aspect of networking and computer security includes application segmentation, wherein the tabular data relates to users, data associated with the users, and application permissions for the users.
12 . The non-transitory computer-readable medium of claim 9 , wherein the aspect of networking and computer security includes application segmentation, wherein the tabular data relates to users, identification information for the users, and server ports for applications are used by the users, and
wherein the machine learning model is trained to determine which of the applications a new user should have access permissions.
13 . The non-transitory computer-readable medium of claim 9 , wherein the aspect of networking and computer security includes classifications, wherein the tabular data relates to transactions and associated classifications.
14 . The non-transitory computer-readable medium of claim 13 , wherein the classifications are for content of an associated Uniform Resource Location (URL).
15 . An apparatus comprising:
one or more processors and memory storing instructions that, when executed, cause the one or more processors to:
obtain tabular data related to an aspect of networking and computer security;
convert the tabular data to natural language for each row in the tabular data, wherein converting includes serializing, for each row, feature names and corresponding feature values into a natural language string that preserves relationships among the feature names and feature values within the row;
input the natural language for each row in the tabular data into a Large Language Model (LLM);
obtain an output from the LLM for each row in the tabular data with embedded data therewith; and
utilize the output to train a machine learning model related to the aspect of networking and computer security,
wherein the embedded data includes, for each row, an embedding vector generated by the LLM from the natural language string for that row to train the machine learning model, the embedding vector capturing relationships between elements within each row of the tabular data, and wherein utilizing the output to train the machine learning model includes using the embedding vector as an input feature for training the machine learning model or for initializing a knowledge graph used to train the machine learning model.
16 . The apparatus of claim 15 , wherein the tabular data is obtained from a cloud-based system, and wherein the tabular data includes data collected based on inline monitoring of users, the Internet, and cloud services.
17 . The apparatus of claim 15 , wherein the aspect of networking and computer security includes application segmentation, wherein the tabular data relates to users, data associated with the users, and application permissions for the users.
18 . The apparatus of claim 17 , wherein the machine learning model is trained to determine what applications a new user should have access permissions.
19 . The apparatus of claim 15 , wherein the aspect of networking and computer security includes application segmentation, wherein the tabular data relates to users, identification information for the users, and server ports for applications are used by the users, and
wherein the machine learning model is trained to determine which of the applications a new user should have access permissions.
20 . The apparatus of claim 15 , wherein the aspect of networking and computer security includes classifications, wherein the tabular data relates to transactions and associated classifications.