Systems and methods for responding to information security incidents using large language models

Abstract

The invention discloses a system and method for security monitoring and accident response using a large language model. In one aspect, an exemplary method includes receiving input data from a secure operation center (SOC) element; generating a query based on the received input data and sending the query to a large language model (LLM); parsing a response received from the LLM; and performing an analysis to determine whether a threat has been identified. In one aspect, the method further includes, when a threat is identified, collecting artifacts of the threat and further analyzing the threat with participation of a security professional; when the threat is not recognized, determining whether additional data is required, and when additional data is required, determining a type of the additional data; when the type of the additional data is determined, collecting additional information from the SOC element; and terminating the accident response when additional data is not needed.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to Russian Patent Application No. RU2023117904 filed on July 6, 2023, the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present invention relates to the field of information technology, and more particularly, to a system and method for using a large language model in security monitoring and incident response. Background Art

[0004] Currently, more and more companies are using Security Operations Center (SOC), which is attributed to the growth of the number of information threats, the complexity of corporate infrastructure, and the requirements of official agencies and regulators to prevent user data from being stolen or illegally used. In recent years, the average amount of damage from information security incidents (hereinafter referred to as incidents) has also increased. These incidents involve the penetration of corporate infrastructure, and according to IBM's data breach cost report, the average amount of damage in 2022 exceeded five million US dollars.

[0005] SOC specialists process data collected from employee workplaces, network devices and other computer infrastructure (so-called artifacts, i.e. documents and other files related to incidents) to detect and prevent possible incidents from developing into attacks as early as possible. For monitoring and data collection, specialists can use Security Information and Event Management (SIEM) solutions and Endpoint Detection and Response (EDR) products (e.g., Kaspersky Unified Monitoring and Analysis Platform), as well as Intrusion Prevention System (IPS) and Entity Behavior Analytics (UEBA) systems.

[0006] Based on data that may indicate a possible incident, the SOC determines whether a threat exists and, if so, what its parameters are, such as type (e.g., inappropriate content, unauthorized access, information leakage) or source (e.g., on which computer was spyware detected). If a possible incident is detected, steps are taken to eliminate the incident and minimize the damage.

[0007] Although many functions of various SIEM solutions are automated, the expertise of computer security experts is still used to correctly identify incidents, which can lead to possible incidents being overlooked because humans may not always have access to the latest information about recent incidents and related artifacts. Increasing the number of information sources related to incidents also does not always help solve the problem because it takes time to add them to the SOC. In addition, the experts themselves may not always have enough time and expertise to identify and handle important artifacts because there may be thousands of artifacts themselves. This problem is particularly relevant in the case of Advanced Persistent Threat (APT) attacks, when both the SOC experts and the SIEM system may be unaware of the incident pattern.

[0008] There are various automated systems for processing information about computer incidents. However, the well-known systems do not solve the above problems, which is associated with a lack of time and expertise in terms of experts and information systems. Threat researchers often publish their findings (attackers' methods, techniques and procedures) online in the form of reports, presentations, blog posts, tweets, and other content. It takes a long time before this knowledge is systematized and applied within SOC teams and SIEM solutions.

[0009] Therefore, there is a need for methods and systems for improving the use of large language models in security monitoring and incident response. Summary of the invention

[0010] Aspects of the present invention relate to systems and methods for security monitoring and incident response using large language models.

[0011] In one exemplary aspect, a method for security monitoring and incident response using a large language model is disclosed, the method comprising: receiving input data from one or more security operations center (SOC) elements; generating queries based on the received input data and sending the generated queries to a large language model (LLM); receiving responses from the LLM and parsing the responses received from the LLM; and performing analysis on the responses received from the LLM to determine whether a threat has been identified based on a result of the responses received from the LLM.

[0012] In one aspect, the method further includes: when a threat is identified, collecting artifacts of the threat using the SOC element and further analyzing the threat with the participation of security professionals within the SOC; when no threat is identified, determining whether the LLM requires additional data, and when additional data is required, determining the type of additional data required; when the type of additional data is determined, collecting additional information from at least one of the SOC elements; and when the LLM does not require additional data or when the type of additional data is not determined, terminating the security monitoring and incident response.

[0013] In one aspect, the additional data is determined based on the presence of at least one specific word from a list of specific words in the response received from the LLM.

[0014] In one aspect, parsing the response received from the LLM is performed using any number of natural language processing libraries.

[0015] In one aspect, parsing the response received from the LLM is performed using a set of regular expressions for identifying text elements.

[0016] In one aspect, the security monitoring center element is security information and event management (SIEM).

[0017] In one aspect, the information security monitoring center element is endpoint detection and response (EDR).

[0018] According to one aspect of the present invention, a system for security monitoring and incident response by using a large language model is provided, the system comprising: at least one memory; and at least one hardware processor, the at least one hardware processor being connected to the at least one memory and configured, alone or in combination, to: receive input data from one or more security operation center (SOC) elements; generate queries based on the received input data and send the generated queries to a large language model (LLM); receive responses from the LLM and parse the responses received from the LLM; and perform analysis on the responses received from the LLM to determine whether a threat has been identified based on the results of the responses received from the LLM.

[0019] In one exemplary aspect, a non-transitory computer-readable medium is provided, on which is stored an instruction set for security monitoring and incident response using a large language model, the instruction set including instructions for: receiving input data from one or more security operations center (SOC) elements; generating queries based on the received input data and sending the generated queries to a large language model (LLM); receiving a response from the LLM and parsing the response received from the LLM; and performing analysis on the response received from the LLM to determine whether a threat has been identified based on a result of the response received from the LLM.

[0020] The method and system of the present invention are designed to improve security monitoring and incident response by using large language models. The technical effect of the method is to reduce the collection time and improve the level of processing information (artifacts) during the investigation of information security incidents. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate one or more exemplary aspects of the invention and, together with the detailed description, serve to explain the principles and implementations of these exemplary aspects.

[0022] Figure 1 A block diagram of an exemplary system for security monitoring and incident response using large language models according to aspects of the present invention is shown.

[0023] Figure 2 An example of a method for security monitoring and incident response using a large language model according to aspects of the present invention is shown.

[0024] Figure 3 An example of a general purpose computer system on which aspects of the present invention for security monitoring and incident response through the use of large language models may be implemented is presented. DETAILED DESCRIPTION

[0025] Exemplary aspects are described herein in the context of systems, methods, and computer programs for security monitoring and incident response using large language models according to various aspects of the present invention. It will be appreciated by those of ordinary skill in the art that the following description is illustrative only and is not intended to be limiting in any way. Other aspects will readily occur to those of ordinary skill in the art who understand the present invention. Reference will now be made in detail to the implementation of the exemplary aspects as shown in the accompanying drawings. Throughout the drawings and the following description, the same reference numerals will be used as much as possible for the same or similar items.

[0026] In some aspects of the present invention, part or all of the system for security monitoring and incident response using a large language model may be implemented on a general purpose computer (e.g., Figure 3 In this case, the components of the system may be implemented within a single computing device or distributed among several interconnected computing devices.

[0027] In order to clearly describe the teachings of the present invention, an explanation of terms and concepts is first provided below.

[0028] The Security Operations Center (SOC) includes a structural unit of the organization responsible for operational monitoring of the IT environment and prevention of information security incidents (hereinafter referred to as incidents). SOC specialists collect and analyze data from various objects of the organization's infrastructure and, if suspicious activity is detected, take measures to prevent attacks. For monitoring and data collection, the following elements are used: SIEM solutions, EDR products, NDR, etc. (hereinafter referred to as SOC elements). In addition, the SOC also uses services such as the Threat Intelligence Platform (for example, the Threat Intelligence Platform described in the document of Kaspersky that can be found at https: / / encyclopedia.kaspersky.ru / glossary / threat-intelligence / ).

[0029] SIEM (Security Information and Event Management) refers to a class of software products designed to collect and analyze information about security events. The tasks of a SIEM system include:

[0030] Real-time monitoring of security alerts from connected devices and applications;

[0031] Processing received data and finding relationships between them;

[0032] Identify deviations from the normal behavior of the controlled system; and

[0033] · Alert SOC experts of detected incidents.

[0034] EDR (Endpoint Detection and Response) refers to a class of solutions used to detect and learn from malicious activity on endpoints (connected workstations, servers, Internet of Things (IoT) devices, etc.).

[0035] SOC specialists (Information Security Professionals) are employees who are responsible for collecting and analyzing incident-related data. Typically, information security professionals or specialists work within the framework of the SOC using products at the level of SIEM, EDR, and other data collection and incident tracking means.

[0036] In the field of computer security, an indicator of compromise (IoC) refers to an object or activity observed on a network or on a specified device that indicates unauthorized access to the system with a high probability, which also indicates that the object or activity has been compromised.

[0037] For example, the following factors serve as damage indicators:

[0038] Unusual DNS queries

[0039] Suspicious files, applications, and processes;

[0040] IP addresses and domains belonging to botnets or malicious C&C servers;

[0041] Large numbers of login attempts (brute force attempts);

[0042] Suspicious activity in administrator or privileged user accounts;

[0043] Unexpected software updates

[0044] Unauthorized (illegal) software installation;

[0045] Transmit data through rarely used ports;

[0046] Atypical human behavior on the site;

[0047] The malware’s signature or hash sum;

[0048] Unusual size of HTML responses;

[0049] Unauthorized modification of device configuration files, registries, or settings.

[0050] A large language model (LLM) is a language model consisting of a neural network with many parameters (typically billions of weights or more) trained on a large amount of text. Thus, a query is sent to an LLM, e.g., the LLM is trained to process natural language, where the training is performed using a neural network with many parameters and respective weights, and a large amount of text. For example, an LLM that is processing natural language may be trained using billions or more parameters and weights, and a large amount of text.

[0051] Figure 1A block diagram of an exemplary system 100 for security monitoring and incident response using a large language model according to various aspects of the present invention is shown. System 100 includes a SOC element 102. Security professionals 101 and SOC elements 102 interact with trained LLMs 105 through request processors 104. SOC elements 102 include SIEM solutions, EDR products, etc. In one aspect, information security professionals 101 interact with LLMs 105 through a network interface of request processors 104. SOC elements 102 collect data from endpoint devices 107 of enterprise infrastructure 106 to collect and analyze information about security events. Examples of endpoint devices 107 include computers (hosts) and devices such as smartphones, routers, and IoT devices. In a preferred aspect, the EDR solution is installed on endpoint devices 107.

[0052] Enterprise infrastructure 106 may also include Figure 1 Other equipment not mentioned in the , namely access control systems, Supervisory Control and Data Acquisition (SCADA), Programmable Logic Controller (PLC) units, and other hardware and software systems of modern enterprises.

[0053] In one aspect, LLM 105 operates based on natural language queries. In this case, request processor 104 performs the function of converting I / O requests from SOC elements into the input format required by LLM, and vice versa (eg, JSON / XML).

[0054] In another aspect, LLM 105 is also trained on texts obtained from various blogs, articles and publications related to information security incidents (eg, DFIR reports) and threat research (eg, securelist.com).

[0055] The request processor 104 is also used to store the context in the form of requests and responses used when interacting with the LLM 105, thereby maximizing the effectiveness of interacting with the LLM 105. The context includes all previous requests to the LLM 105 and the responses received.

[0056] In one aspect, the request processor 104 is implemented using a natural language processing library (e.g., SpaCy, NTLK, etc.). In another aspect, the request processor 104 uses a set of regular expressions to extract text elements from the response received from the LLM 105. Tokens, N-Grams, or lexemes are used as text elements.

[0057] Security professionals 101 and SOC elements 102 transmit data collected from one or more endpoint devices 107 to request processor 104 regarding:

[0058] Modules configured for automatic execution (auto-running);

[0059] Run the process and its command line (arguments);

[0060] Events from the operating system (OS) log: service installation, process start, PowerShell script execution, etc.

[0061] Events from application logs (anti-virus programs, browsers, or remote system administration);

[0062] Meta information about files (process and system files): name, path, hash, meta information from the manifest (original name, description, developer name), information about digital signatures, code strings from the file, debug information, section names, disassembled / decompiled (or exported by DLLs) code to the entry point of the executable, part of a text file of a script; and

[0063] - File execution information (e.g., in an emulator or in a virtual machine), which includes a log of system API function calls and their arguments, and additional information such as open file descriptors (handlers).

[0064] In one aspect, LLM 105 cannot properly accept this data as input, so request processor 104 converts the data into a request of the following type:

[0065] 1) Is the following Windows service name “$ServiceName” followed by the next startup line “$Servicecmd” an indicator of compromise?

[0066] 2) Are any of the following Windows services with a suitable command line an indicator of compromise?

[0067]

[0068] The response from LLM 105 includes a text description that can be easily interpreted by information security professional 101. For example, a sample answer could be:

[0069] “Yes, specified combinations of running processes and command lines can be indicators of compromise”.

[0070] LLM 105 also provides information in response to questions such as:

[0071] "The metadata are indicators of compromise, such as 'the command line is attempting to download a file from an external server' or 'it is using the -ep bypass flag, which instructs PowerShell to bypass standard security checks'."

[0072] The request processor 104 interprets the response from the LLM 105 by highlighting key phrases. An example of such a phrase is a response that includes the word "yes," which gives an affirmative answer to the original query. In addition, to simplify the interpretation of the response from the LLM 105, the request processor 104 adds the following text to the request:

[0073] Your response should be a json object with the following structure:

[0074] {short_answer:”yes / no”,

[0075] long_answer_with description:full_text,

[0076] other_data_required_to_investigate_incident:full_text

[0077] }

[0078] When such a keyword phrase is detected, the request processor 104:

[0079] Transmitting alarm signals to SOC components 102 and information security professionals 101;

[0080] Sending a request to collect additional data from one of the endpoint devices 107 on which the requested original data was collected; and

[0081] Initiate (trigger) a response action (eg, block one or more endpoint devices 107, such as a host).

[0082] Thus, request processor 104 works with LLM 105 in a question-and-answer mode, wherein request processor 104 uses keyword phrases to construct questions as part of an LLM 105 query and relies on keyword phrase searches to find affirmative answers to the original questions or to determine that additional questions are needed when analyzing responses from LLM 105.

[0083] Figure 2 An example of a method 200 for security monitoring and incident response using a large language model according to aspects of the present invention is shown.

[0084] In step 201, the method 200 receives input from one or more SOC (Security Operation Center) elements. Typically, the SOC elements 102 collect input from endpoint devices 107 of the enterprise infrastructure 106 (examples of the collected data are described above).

[0085] In step 202, the method 200 generates a query based on the received input and sends the query to the LLM 105. Because the query to the LLM 105 is generated in natural language, the request processor 104 adds the following keyword group to the input:

[0086] "The combination of..." is" - List the required data,

[0087] “Is it an indicator of compromise?”, “Is it a threat?”, “Is it an attack?”, “Is it a cyberattack?”, “Is it a malicious action / file?” - questions about threats.

[0088] "Think about it step by step" - ask for a step-by-step answer,

[0089] "Is the file existing on the hard disk" - query for the specified file.

[0090] These phrases are stored in the request processor 104 itself (e.g., as a list) and in a separate database ( Figure 1 Not shown in the figure).

[0091] For example, the query could be as follows:

[0092] Is the combination of the process “C:\Users\User01\AppData\Local\Temp\dOlnolh.exe” and the command line “-EgUxRCdQ” an indicator of compromise?

[0093] According to the request submitted, the input data is:

[0094] Object Type Object process C:\Users\User01\AppData\Local\Temp\dOlnolh.exe Command Line -EqU

[0095] Data about the process and the command line used to start it are obtained from the EDR installed on one of the endpoint devices 107 (eg, host). The request processor 104 lists the specified objects in the request and adds the above keyword phrases to construct a natural language query.

[0096] In step 203, method 200 receives a response from LLM 105 via request processor 104 and parses the received response. Because LLM 105 outputs the response in natural language text, request processor 104 uses a connected natural language processing library (e.g., SpaCy or NTLK) to highlight desired terms and phrases. Analysis includes highlighting pre-known phrases or text elements. Tokens, N-Grams, or lexemes are used as text elements. In one aspect, highlighting known phrases is accomplished using regular expressions.

[0097] In step 204, the method 200 determines whether a threat has been identified based on the results of the analysis of the parsed response received from the LLM 105. The criteria for identifying a threat is based on determining the presence of certain phrases in the response. For example, in one implementation, the determination is based on searching the response for the word "yes" and other affirmative answers. Other key phrases that can be similarly used are: "This may be an indicator of compromise," "This is suspicious behavior." If a threat is identified, the method 200 proceeds to step 205. If a threat is not identified in step 204, the method 200 proceeds to step 206.

[0098] In step 205, method 200 collects artifacts of the threat using SOC elements 102 and further analyzes the incident / threat within the SOC with the involvement of security professionals 101. In one aspect, the method terminates after step 205. In another aspect, the method continues with step 206 to assess whether more data is needed.

[0099] In step 206, method 200 determines whether LLM 105 requires more data, and if applicable, what type of additional data is required. For example, key phrases in this case may include: "should be further investigated", "additional data required", "further analysis necessary", and other similar phrases. The specified phrases are stored in the request processor 104 itself (e.g., as a list) and in a separate database ( Figure 1 In addition, what type of information is needed is analyzed based on the presence of the following words:

[0100] Endpoint, Host, Local—means that information needs to be collected from the endpoint device 107 (e.g., host);

[0101] Registry - requires information from the registry;

[0102] Documentation – Information about documentation activities is required;

[0103] Network—needs network activity information;

[0104] Process—process information is required;

[0105] Autorun—Need more information about the Autorun key; and

[0106] PowerShell—Requires optional parsing of PowerShell scripts.

[0107] In one aspect, the context in which these words are associated is also analyzed. For example, the word "process" can be defined as "running process", which only means running process.

[0108] In the event that the request processor 104 is unable to identify what additional data may be required, the method proceeds from step 206 to step 207. Otherwise, once the necessary additional information has been determined, the method 200 proceeds from step 206 to step 208.

[0109] In step 207 , method 200 terminates.

[0110] In step 208, method 200 collects additional information at a SOC element 102. For example, an EDR solution may be used to collect information from an endpoint device 107 (e.g., from a host). The method then continues with step 202 using the newly collected data until the method completes its operations at step 205 or step 207.

[0111] In one aspect, further training can be done Figure 1 One or more target endpoint devices 107, such as hosts (which may include virtual machines and sandbox objects), are targeted with a malware sample to be infected. For example, the Empire PowerShell framework may be installed and several common malicious routines may be run. Thereafter, according to Figure 2 The method can be used to highlight the necessary requests and responses from LLM 105.

[0112] For example, in response to the query:

[0113] Are the following indicators of damage?

[0114] Startup string:

[0115] “C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe” –

[0116] NonI-W hidden-c "IEX([Text.Encoding]::UNICODE.

[0117] GetString([Convert]::FromBase64String((gp

[0118] HKCU:\Software\Microsoft\Windows\CurrentVersion debug).debug)))".

[0119] LLM 105 then returns the following response:

[0120] Yes, this could be an indicator of compromise. An attacker could have created a malicious task in the registry to launch PowerShell with a hidden flag and a base64-encoded string. This code could potentially execute malicious commands on the system, such as installing malware or stealing data. To confirm if this is indeed an indicator of compromise, it would be necessary to further analyze the script and look for other clues that indicate malicious activity.

[0121] This answer means:

[0122] “Yes, it can be an indicator of compromise. The attacker may have created a malicious registry task to run PowerShell with a hidden flag and a base64-encoded string. This code could potentially execute malicious commands on the system, such as installing malware or stealing data. To confirm if this is indeed an indicator of compromise, it is necessary to further analyze the scenario and look for other signs of malicious activity.”

[0123] Thus, in one aspect, by forming several sequential queries to the LLM 105 using various parameters related to malicious activity on the endpoint device 107 (eg, host), and by obtaining the necessary responses, context may be supplemented that will be used to retrain the LLM 105.

[0124] Figure 3 is a block diagram illustrating a computer system 20 on which aspects of the system and method for security monitoring and incident response using a large language model may be implemented. The computer system 20 may be in the form of multiple computing devices or in the form of a single computing device, such as a desktop computer, a laptop computer, a handheld computer, a mobile computing device, a smartphone, a tablet computer, a server, a mainframe, an embedded device, and other forms of computing devices.

[0125] As shown, computer system 20 includes a central processing unit (CPU) 21, a system memory 22, and a system bus 23 connecting various system components, including a memory associated with central processing unit 21. System bus 23 may include a bus memory or a bus memory controller, a peripheral bus, and a local bus capable of interacting with any other bus architecture. Examples of buses may include PCI, ISA, PCI-Express, HyperTransport, and the like. TM (HyperTransport TM ), unlimited bandwidth TM (InfiniBand TM ), Serial ATA, I 2 C, and other suitable interconnections. The central processing unit 21 (also referred to as a processor) may include a single group or multiple groups of processors having a single core or multiple cores. The processor 21 may execute one or more computer executable codes that implement the technology of the present invention. The system memory 22 may be any memory for storing data used herein and / or computer programs executable by the processor 21. The system memory 22 may include volatile memory (such as random access memory (Random Access Memory, RAM) 25) and non-volatile memory (such as read-only memory (Read-Only Memory, ROM) 24, flash memory, etc.) or any combination thereof. The basic input / output system (Basic Input / Output System, BIOS) 26 may store basic programs for transmitting information between elements of the computer system 20, such as those basic programs when the operating system is loaded using ROM 24.

[0126] The computer system 20 may include one or more storage devices, such as one or more removable storage devices 27, one or more non-removable storage devices 28, or a combination thereof. The one or more removable storage devices 27 and the one or more non-removable storage devices 28 are connected to the system bus 23 via a storage device interface 32. In one aspect, the storage devices and corresponding computer-readable storage media are power-independent modules for storing computer instructions, data structures, program modules, and other data of the computer system 20. The system memory 22, the removable storage devices 27, and the non-removable storage devices 28 may use a variety of computer-readable storage media. Examples of computer-readable storage media include: machine memory, such as cache, SRAM, DRAM, zero-capacitor RAM, two-transistor RAM, eDRAM, EDO RAM, DDR RAM, EEPROM, NRAM, RRAM, SONOS, PRAM; flash memory or other storage technology, such as in a Solid State Drive (SSD) or a flash drive; magnetic cassettes, tapes, and disk storage, such as in a hard drive or floppy disk; optical storage, such as in a compact disk (CD-ROM) or a digital versatile disk (DVD); and any other medium that can be used to store the desired data and can be accessed by the computer system 20.

[0127] The system memory 22, removable storage device 27 and non-removable storage device 28 of computer system 20 can be used to store operating system 35, additional application programs 37, other program modules 38 and program data 39. Computer system 20 may include a peripheral interface 46 for transmitting data from input device 40, such as a keyboard, mouse, stylus, game controller, voice input device, touch input device, or other peripheral devices, such as a printer or scanner via one or more I / O ports, such as a serial port, parallel port, Universal Serial Bus (USB), or other peripheral interfaces. Display device 47 (such as one or more monitors, projectors or integrated displays) can also be connected to system bus 23 via output interface 48 (such as a video adapter). In addition to display device 47, computer system 20 can also be equipped with other peripheral output devices (not shown), such as speakers and other audio-visual devices.

[0128] The computer system 20 can work in a network environment using a network connection with one or more remote computers 49. The one or more remote computers 49 can be local computer workstations or servers, which include most or all of the elements described above in describing the properties of the computer system 20. Other devices can also be present in the computer network, such as but not limited to routers, network sites, peer devices or other network nodes. The computer system 20 may include one or more network interfaces 51 or network adapters for communicating with the remote computer 49 through one or more networks, such as a computer local area network (LAN) 50, a computer wide area network (WAN), an intranet, and the Internet. Examples of the network interface 51 may include an Ethernet interface, a frame relay interface, a SONET (synchronous optical network) interface, and a wireless interface.

[0129] Various aspects of the present invention may be systems, methods and / or computer program products. The computer program products may include one or more computer-readable storage media having computer-readable program instructions for causing a processor to perform various aspects of the present invention.

[0130] Computer readable storage medium can be a tangible device, and this tangible device can keep and store the program code of the form of instruction or data structure, and this program code can be accessed by the processor of computing device (such as computer system 20).Computer readable storage medium can be electronic storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device or its any suitable combination.As an example, this type of computer readable storage medium can include random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), portable optical disc read-only memory (CD-ROM), digital versatile disc (DVD), flash memory, hard disk, portable computer disk, memory stick, floppy disk or even mechanical coding device, such as punch card or convex structure in the groove of recording instruction thereon.As used in this article, computer readable storage medium should not be regarded as temporary signal itself, temporary signal such as radio wave or other free propagation electromagnetic wave, electromagnetic wave propagated by waveguide or transmission medium or electric signal transmitted by wire.

[0131] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing device, or downloaded to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network interface in each computing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in the corresponding computing device.

[0132] The computer-readable program instructions for performing the operation of the present invention can be assembly instructions, instruction set architecture (Instruction-Set-Architecture, ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data or source code or object code written in any combination of one or more programming languages ​​(including object-oriented programming languages ​​and traditional programmed programming languages).Computer-readable program instructions (as independent software packages) can be performed completely on the user's computer, partly on the user's computer, partly on the user's computer and partly on a remote computer or completely on a remote computer or server.In the latter case, the remote computer can be connected to the user's computer through any type of network (including LAN or WAN), or can be connected to an external computer (for example, through the Internet).In some respects, electronic circuits (including for example programmable logic circuits, field programmable gate arrays (FPGAs) or programmable logic arrays (Programmable Logic Arrays, PLAs)) can be performed by utilizing the state information of computer-readable program instructions to personalize the electronic circuit, thereby performing various aspects of the present invention.

[0133] In various aspects, the systems and methods described in the present invention can be processed in modules. The term "module" as used herein refers to, for example, a real-world device, component, or arrangement of components implemented using hardware (e.g., by an application-specific integrated circuit (ASIC) or FPGA), or to a combination of hardware and software, such as a microprocessor system and an instruction set that implements the module's functionality (the instruction set converts the microprocessor system into a dedicated device when executed). A module can also be implemented as a combination of two modules, where certain functions are facilitated by hardware alone and other functions are facilitated by a combination of hardware and software. In some implementations, at least a portion of a module (and in some cases, all of a module) can be implemented in a computer system (e.g., the above Figure 3Therefore, each module can be implemented in various suitable configurations and should not be limited to any specific implementation illustrated in this article.

[0134] For the sake of clarity, not all routine features of various aspects are disclosed herein. It should be appreciated that in the development of any practical implementation of the present invention, many specific implementation decisions must be made in order to achieve the developer's specific goals, and these specific goals will vary for different implementations and different developers. It should be understood that such development efforts can be complex and time-consuming, but are still a routine task of engineering for those of ordinary skill in the art who understand the advantages of the present invention.

[0135] In addition, it should be understood that the words or terms used herein are for the purpose of description rather than limitation, so the terms or terms of this specification should be interpreted by those skilled in the art according to the teachings and guidance provided herein in combination with the knowledge of (one or more) relevant technical personnel. In addition, it is not intended to attribute any term in this specification or claims to an uncommon or special meaning unless explicitly stated as such.

[0136] The various aspects disclosed herein include the present and future known equivalents of the known modules cited herein in an illustrative manner. In addition, although various aspects and applications have been shown and described, it will be apparent to those skilled in the art who understand the advantages of the present invention that more modifications than those mentioned above are feasible without departing from the inventive concept disclosed herein.

Claims

1. A method for security monitoring and incident response using a large language model, the method comprising: receiving input data from one or more security operations center (SOC) elements; generating a query based on the received input data and sending the generated query to a large language model (LLM); receiving a response from the LLM and parsing the response received from the LLM; as well as An analysis is performed on the response received from the LLM to determine whether a threat has been identified based on a result of the response received from the LLM.

2. The method of claim 1, further comprising: When a threat is identified, collecting artifacts of the threat using the SOC elements and further analyzing the threat with the involvement of security professionals within the SOC; When no threat is identified, determining whether the LLM requires additional data, and when additional data is required, determining the type of additional data required; When the type of the additional data is determined, collecting additional information from at least one of the SOC components; as well as When the LLM does not require additional data or when the type of the additional data is not determined, the security monitoring and incident response are terminated.

3. The method of claim 2, wherein: The additional data is determined based on the presence of at least one specific word in a list of specific words in the response received from the LLM.

4. The method of claim 1, wherein: The parsing of the response received from the LLM is performed using any number of natural language processing libraries.

5. The method of claim 1, wherein: The parsing of the response received from the LLM is performed using a set of regular expressions for identifying text elements.

6. The method of claim 1, wherein: The security monitoring center element is security information and event management (SIEM).

7. The method of claim 1, wherein: The security monitoring center element is endpoint detection and response (EDR).

8. A system for security monitoring and incident response using a large language model, comprising: at least one memory; as well as at least one hardware processor coupled to the at least one memory and configured, alone or in combination, to: receiving input data from one or more security operations center (SOC) elements; generating a query based on the received input data and sending the generated query to a large language model (LLM); receiving a response from the LLM and parsing the response received from the LLM; as well as An analysis is performed on the response received from the LLM to determine whether a threat has been identified based on a result of the response received from the LLM.

9. The system of claim 8, wherein: The at least one hardware processor is further configured to: When a threat is identified, collecting artifacts of the threat using the SOC elements and further analyzing the threat with the involvement of security professionals within the SOC; When no threat is identified, determining whether the LLM requires additional data, and when additional data is required, determining the type of additional data required; When the type of the additional data is determined, collecting additional information from at least one of the SOC components; as well as When the LLM does not require additional data or when the type of the additional data is not determined, the security monitoring and incident response are terminated.

10. The system of claim 9, wherein: The additional data is determined based on the presence of at least one specific word in a list of specific words in the response received from the LLM.

11. The system of claim 8, wherein: The parsing of the response received from the LLM is performed using any number of natural language processing libraries.

12. The system of claim 8, wherein: The parsing of the response received from the LLM is performed using a set of regular expressions for identifying text elements.

13. The system of claim 8, wherein: The security monitoring center element is security information and event management (SIEM).

14. The system of claim 8, wherein: The security monitoring center element is endpoint detection and response (EDR).

15. A non-transitory computer-readable medium having stored thereon computer-executable instructions for security monitoring and incident response using a large language model, the computer-executable instructions comprising instructions for: receiving input data from one or more security operations center (SOC) elements; generating a query based on the received input data and sending the generated query to a large language model (LLM); receiving a response from the LLM and parsing the response received from the LLM; as well as An analysis is performed on the response received from the LLM to determine whether a threat has been identified based on a result of the response received from the LLM.

16. The non-transitory computer readable medium of claim 15, wherein: The computer executable instructions for security monitoring and incident response using large language models also include instructions for: When a threat is identified, collecting artifacts of the threat using the SOC elements and further analyzing the threat with the involvement of security professionals within the SOC; When no threat is identified, determining whether the LLM requires additional data, and when additional data is required, determining the type of additional data required; When the type of the additional data is determined, collecting additional information from at least one of the SOC components; as well as When the LLM does not require additional data or when the type of the additional data is not determined, the security monitoring and incident response are terminated.

17. The non-transitory computer readable medium of claim 16, wherein: The additional data is determined based on the presence of at least one specific word in a list of specific words in the response received from the LLM.

18. The non-transitory computer readable medium of claim 15, wherein: The parsing of the response received from the LLM is performed using any number of natural language processing libraries.

19. The non-transitory computer readable medium of claim 15, wherein: The parsing of the response received from the LLM is performed using a set of regular expressions for identifying text elements.

20. The non-transitory computer readable medium of claim 15, wherein: The security monitoring center element is security information and event management (SIEM).

Images