System and method for providing threat intelligence

Abstract

A method for providing threat intelligence, the method constituted of: based at least in part on a cyber-model associated with an asset, generating a plurality of keywords; based at least in part on the generated keywords, searching one or more data sources to retrieve data associated with the cyber-model, the retrieved data comprising information regarding threats and / or vulnerabilities associated with the asset; and based at least in part on the retrieved data, updating the cyber-model.

Description

SYSTEM AND METHOD FOR PROVIDING THREAT INTELLIGENCETECHNICAL FIELD

[0001] The present disclosure relates generally to the field of threat intelligence.BACKGROUND

[0002] Threat intelligence is the gathering and analysis of multi-source cybersecurity data using various algorithms. By collecting large amounts of data about current cybersecurity threats and trends and performing analytics on this data, threat intelligence providers can derive usable data and insights that help their customers to better detect and prepare for threats.

[0003] Organizations have a wide range of threat intelligence needs, ranging from low- level information on the malware variants currently being used in attack campaigns to high- level information intended to inform strategic investments and policy creation. For this reason, threat intelligence can be classified into one of three different types:

[0004] 1. Operational: Operational threat intelligence focuses on the tools (malware, infrastructure, etc.) and techniques that cyber attackers use to achieve their goals. This type of understanding helps analysts and threat hunters identify and understand attack campaigns.

[0005] 2. Strategic: Strategic threat intelligence is high-level and focuses on widespread trends within the cyber threat landscape. This type of threat intelligence is geared toward executives (often without a cybersecurity background) that need to understand their organization’s cyber risk as part of their strategic planning.

[0006] 3. Tactical: Tactical threat intelligence focuses on identifying particular types of malware or other cyberattacks using compromise (loCs) indicators. This type of threat intelligence is ingested by cybersecurity solutions and used to detect and block incoming or ongoing attacks.SUMMARY

[0007] Accordingly, it is a principal object of the present invention to overcome at least some of the disadvantages of prior art systems and methods for network traffic security prioritization. This is provided in some examples by a method for providing threat intelligence, the method comprising, based at least in part on a cyber-model associated with an asset, generating a plurality of keywords.

[0008] In some examples, based at least in part on the generated keywords, the method comprises searching one or more data sources to retrieve data associated with the cyber-model. In some examples, the retrieved data comprising information regarding threats and / or vulnerabilities associated with the asset.

[0009] In some examples, based at least in part on the retrieved data, the method comprises updating the cyber-model.

[0010] In some examples, the method comprises utilizing a large language model (LLM) to summarize at least a portion of the retrieved data.

[0011] Additional features and advantages of the invention will become apparent from the following drawings and description.

[0012] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. In case of conflict, the patent specification, including definitions, governs. As used herein, the articles "a" and "an" mean "at least one" or "one or more" unless the context clearly dictates otherwise. As utilized herein, “and / or” means any one or more of the items in the list joined by “and / or”. As an example, “x and / or y” means any element of the three-element set {(x), (y), (x, y) } . In other words, “x and / or y” means “x, y or both of x and y”. As some examples, “x, y, and / or z” means any element of the seven-element set {(x), (y), (z), (x, y), (x, z), (y, z), (x, y, z)}.

[0013] Further, unless expressly stated to the contrary, “or” refers to an inclusive or and not to an exclusive or. For example, a condition A or B is satisfied by anyone of the following: A is true (or present) and B is false (or not present), A is false (or not present) and B is true (or present), and both A and B are true (or present).

[0014] In addition, use of the “a” or “an” are employed to describe elements and components of embodiments of the instant inventive concepts. This is done merely for convenience and to give a general sense of the inventive concepts, and “a” and “an” are intended to include one or at least one and the singular also includes the plural unless it is obvious that it is meant otherwise.

[0015] As used herein, the term "about", when referring to a measurable value such as an amount, a temporal duration, and the like, is meant to encompass variations of + / -10%, more preferably + / -5%, even more preferably + / -1%, and still more preferably + / -0.1% from the specified value, as such variations are appropriate to perform the disclosed devices and / or methods.

[0016] The following embodiments and aspects thereof are described and illustrated in conjunction with systems, tools and methods which are meant to be exemplary and illustrative, but not limiting in scope. In various embodiments, one or more of the above-described problems have been reduced or eliminated, while other embodiments are directed to other advantages or improvements.BRIEF DESCRIPTION OF DRAWINGS

[0017] For a better understanding of the invention and to show how the same may be carried into effect, reference will now be made, purely by way of example, to the accompanying drawings in which like numerals designate corresponding sections or elements throughout.

[0018] With specific reference now to the drawings in detail, it is stressed that the particulars shown are by way of example and for purposes of illustrative discussion of the preferred embodiments of the present invention only and are presented in the cause of providing what is believed to be the most useful and readily understood description of the principles and conceptual aspects of the invention. In this regard, no attempt is made to show structural details of the invention in more detail than is necessary for a fundamental understanding of the invention, the description taken with the drawings making apparent to those skilled in the art how several forms of the invention may be embodied in practice.

[0019] In the drawings:

[0020] FIG. 1 illustrates a high-level block diagram of threat intelligence system, in accordance with some examples of the disclosure;

[0021] FIG. 2A illustrates a high-level flow chart of a first method for providing threat intelligence, in accordance with some examples of the disclosure;

[0022] FIG. 2B illustrates a high-level block diagram of a module for fine-tuning an LLM, in accordance with some examples of the disclosure;

[0023] FIG. 2C illustrates a high-level flow chart of a method for fine-tuning an LLM, in accordance with some examples of the disclosure;

[0024] FIG. 2D illustrates a high-level flow chart of a method of updating TARA data based on one or more textual attack paths, in accordance with some examples of the disclosure;

[0025] FIG. 3 illustrates a high-level flow chart of a second method for providing threat intelligence, based on a cyber-model, in accordance with some examples of the disclosure;

[0026] FIG. 4A illustrates a high-level block diagram of a system for identifying communication paths, in accordance with some examples of the disclosure; and

[0027] FIG. 4B illustrates a high-level flow chart of a method for using an LLM to identify communication paths within a system.DETAILED DESCRIPTION OF CERTAIN EXAMPLES

[0028] In the following description, various aspects of the disclosure will be described. For the purpose of explanation, specific configurations and details are set forth in order to provide a thorough understanding of the different aspects of the disclosure. However, it will also be apparent to one skilled in the art that the disclosure may be practiced without specific details being presented herein. Furthermore, well-known features may be omitted or simplified in order not to obscure the disclosure. In the figures, like reference numerals refer to like parts throughout. In order to avoid undue clutter from having too many reference numbers and lead lines on a particular drawing, some components will be introduced via one or more drawings and not explicitly identified in every subsequent drawing that contains that component.

[0029] The term "asset", as used herein, means a feature performing a functionality or a resource used for performing a functionality. Such a resource can include, for example, a key,a configuration file, or any other appropriate resource, including a hardware component or software component. In some examples, an asset can be one or more components, systems and / or sub-systems of a vehicle. An asset can further be a signal asset, which is a message that can be sent from a source to a destination. In some examples, the signal asset comprises configuration information associated with the message that can be sent.

[0030] The term "fine-tuning", as used herein, means a method where weights of a pretrained model are trained on new data, as known to those skilled in the art. In some examples, as known to those skilled in the art, fine-tuning comprises inputting data into the LLM and the LLM is prompted to fine-tune a predetermined sub-set of weights thereof based on a lossfunction. In some examples, the output of the LLM is input into a second LLM which generates an input for the loss-function, as known to those skilled in the art. It is noted that this is merely one method for performing fine-tuning, and is not meant to be limiting in any way.

[0031] FIG. 1 illustrates a high-level block diagram of a threat intelligence system 10. In some examples, threat intelligence system 10 comprises: a data interface 20; a data retrieval module 30; and a large language model (LLM) 40. In some examples, threat intelligence system 10 comprises one or more processors 11 and a memory 12. In some examples, memory 12 has stored therein instructions, which when read by processor / s 11 cause processor / s 11 to operate data interface 20, data retrieval module 30 and / or LLM 40. Although only a single LLM 40 is described herein, this is not meant to be limiting in any way, and any number of LLMs can be utilized to perform the below described operations of LLM 40. In some examples, system 10 further comprises a user input terminal 45.

[0032] In some examples, data interface 20 comprises a connection to one or more data sources 50. In some examples, data interface 20 comprises one or more of: a connection to the internet; a connection to a database, or databases; or a connection to a repository, or repositories. The databases and / or repositories can be stored within memory 12, within a separate memory, and / or within a different network, and data interface 20 comprises an appropriate connection for any of these options. In some examples, data interface 20 is further in communication with an external system, process and / or network.

[0033] In some examples, the data source / s 50 comprises any of the following: the internet; the national vulnerability database (NVD); the open-source vulnerabilities (OSV) database; a database of exploit code; one or more code repositories; one or more specification sheetsassociated with an asset, optionally stored on memory 12; and / or risk analysis, such as threat analysis and risk assessment (TARA) data associated with the asset, optionally stored on memory 12. It is noted that although the disclosure references TARA, this is not meant to be limiting in any way, and any other risk analysis methodology can be used, such as risk management framework (RMF), Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE), or other methodologies.

[0034] In some examples, the risk analysis data is stored on a dedicated database 60. In some examples, the TARA data comprises a plurality of attack trees, or attack paths. The term "attack tree", or "attack path", as defined herein, is a branching, hierarchical data structure that represents a set of potential approaches to achieving an event in which system security is penetrated or compromised in a specified way. An "attack step", as defined herein, is any node of the attack tree or attack path.

[0035] In some examples, system 10 further comprises a video to text converter 70 that converts speech within a video to text. In some examples, converter 70 comprises a speech recognition algorithm. In some examples, converter 70 further comprises a respective algorithm that identifies text within frames of the video.

[0036] In some examples, data retrieval module 30 comprises an appropriate component, and / or set of instructions, to retrieve data from data source / s 50. In some examples, data retrieval module 30 comprises a search engine. For example, the search engine can be based on a page rank algorithm, or a variant thereof. In some examples, data retrieval module 30 comprises a database management system.

[0037] One illustrative example of LLM 40, without any limitation, is from the LLaMa-2 large language model family, commercially available from Meta Al.

[0038] In some examples, LLM 40 is fine-tuned on predefined data. Although the below is described in relation to fine-tuning of a trained LLM 40, this is not meant to be limiting in any way. In some examples, the below described steps of fine-tuning LLM 40 are performed in the process of training of LLM 40, with the appropriate changes, as known to those skilled in the art.

[0039] In some examples, a list of configuration data, such as software libraries, associated with the asset are input to LLM 40, as will be described below, such that the data output byLLM 40 is relevant to these libraries. The term "associated with the asset", as used herein in relation to configuration data means configuration data that is accessed by the asset and / or accessed configuration data where the asset uses information affected by the accessed configuration data. For example, a first process accesses a library and utilizing the accessed library gets certain data, and stores the data in a queue. A second process, which is part of the asset, retrieves the data from the queue. Thus, in such an example, the library is associated with the asset since the asset retrieves data that is associated with the library.

[0040] In some examples, when prompting LLM 40 to output data based on the list of configuration data, the list of configuration data is input to LLM 40 as a soft prompt. The term "soft prompt", as used herein, means learnable tensors concatenated with the input embeddings.

[0041] In some examples, a specification sheet of the asset is input to LLM 40 , as will be described below, such that the data output by LLM 40 is relevant to the specification sheet. In some examples, when prompting LLM 40 to output data based on the specification sheet, the data in the specification sheet is input to LLM 40 as a soft prompt. In some examples, risk analysis data, such as TARA information, of the asset, is input to LLM 40 such that the data output by LLM 40 is relevant to the risk analysis data, as will be described below. In some examples, when prompting LLM 40 to output data based on the risk analysis data, the risk analysis data, or predetermined parameters thereof, is input to LLM 40 as a soft prompt.

[0042] In some examples, a cyber-model is input to LLM 40, as will be described below, such that the data output by LLM 40 is relevant to the cyber-model. The term "cyber-model associated with an asset", as used herein, means a model of the asset, or of a larger system containing the asset, such as a vehicle. In some examples, the cyber-model comprises data regarding connectivity within the system. In some examples, the connectivity is between components within the system, such as ECUs. In some examples, the connectivity is between assets within the system. In some examples, the data regarding connectivity comprises data regarding connectivity between software elements within the system, optionally without hardware data associated with the software elements. In some examples, the data regarding connectivity comprises data regarding communication protocols between assets in the system.

[0043] In some examples, the cyber-model comprises any, or a combination, of: risk analysis data of the asset / system, such as TARA data; information regarding configuration data of the asset / system; specifications of the asset / system; and / or the operational state of theasset / system. In some examples, the cyber-model is received from the supplier of the asset, such as a vehicle manufacturer. In some examples, when prompting LLM 40 to output data based on the cyber-model, the cyber-model, or predetermined portions thereof, is input to LLM 40 as a soft prompt.

[0044] FIG. 2A illustrates a high-level flow chart of a method for providing threat intelligence using generative Al (i.e., with one or more LLMs), in accordance with some examples. The below method is described in relation to threat intelligence system 10, however this is not meant to be limiting in any way, and any other suitable system can be used to perform the method.

[0045] In some examples, in stage 1000, security information is received, the security information associated with an asset. In some examples, security information comprises: information regarding an attack in the asset; information regarding a threat to the asset; information regarding a vulnerability in the asset; and / or information regarding a potential vulnerability in the asset. In some examples, the security information is input via user terminal 45. In some examples, the security information is received from an external server or from a dedicated program. In some examples, the security information is received at data interface 20. In some examples, the security information comprises a textual description of the attack, the vulnerability, or the potential vulnerability.

[0046] In some examples, an attack in the asset comprises a detected attack. The detected attack may be from a previous time period, or from a currently detected attack.

[0047] In some examples, an attack vulnerability is a known vulnerability of the respective asset to a particular attack. In some examples, the information regarding the attack vulnerability is given in a predetermined format, such as a Common Vulnerabilities and Exposures (CVE) format.

[0048] In some examples, a potential vulnerability is determined based on predetermined vulnerability rules. In some examples, a potential vulnerability is identified based on an identified vulnerability in another asset that is similar to the present asset, in accordance with the predetermined vulnerabilities . In some examples, a potential vulnerability is identified based on received data from the asset that comprise certain unexplained anomalies, in accordance with the predetermined vulnerabilities.

[0049] In some examples, in stage 1010, a plurality of keyworks are generated, based at least in part on the received security information of stage 1000. In some examples, the keywords are generated by processor 12. In some examples, the keywords are generated by LLM 40. In some examples, where the security information comprises a textual description, the textual description is input into LLM 40 and LLM 40 extracts the keywords from the textual description. In some examples, a separate LLM is used for extracting the keywords.

[0050] In some examples, the plurality of keywords are not based on the received security information, rather the plurality of keywords are generated, based at least in part on information contained with the cyber-model associated with the asset. In some examples, the keywords are generated based at least in part on connectivity data of the cyber-model. In some examples, the keywords are generated based at least in part on risk analysis data of the cyber-model. In some examples, the security information is stored in the cyber-model.

[0051] In some examples, as described above, a list of configuration data associated with the asset is input into LLM 40, such that the generated keywords are associated with the list of configuration data. In one non-limiting example, LLM 40 can be prompted to generate keywords from the security information by requesting a list of keywords, optionally associated with the list of configuration data. For example, if the security information contains information regarding vulnerabilities associated with a plurality of libraries, LLM 40 may generate only keywords relating to the vulnerabilities associated with libraries that are in the list of libraries associated with the asset. In some examples, processor 11 inputs the list of libraries into LLM 40

[0052] In some examples, as described above, a specification sheet of the asset is input into LLM 40, such that the generated keywords are associated with the specification sheet. In some examples, as described above, TARA data (e.g., TARA) associated with the asset is input into LLM 40, such that the generated keywords are associated with the TARA data. In some examples, as described above, a cyber-model of the asset, or system containing the asset, is input into LLM 40, such that the generated keywords are associated with the cyber-model.

[0053] In some examples, LLM 40 generates keywords by: extracting words from the textual description of the security information; and providing terms associated with the security information. For example, LLM 40 can be fine-tuned to provide keywords related to the context of the security information. This can include known terms, or attack steps, that are related tothe terms contained within the security information. For example, if the security information comprises a description of a vulnerability to a first type of attack aimed at a first functionality, LLM 40 can provide keywords related to other types of attack aimed at the first functionality. Additionally, LLM 40 can provide keywords related to the first type of attack, but that is aimed at different functionalities that are in communication with the first functionality.

[0054] Although the above has been described in relation to examples where the keywords are generated by LLM 40, or a separate LLM, this is not meant to be limiting in any way, and processor 11 can initiate any suitable algorithm for generating keywords from the received security information. As described above in relation to LLM 40, such an algorithm can generate keywords that are associated with a list of configuration data, specification sheet and / or TARA data associated with the asset.

[0055] In some examples, a plurality of keywords are generated by LLM 40, or a respective algorithm of processor 11, and processor 11 further filters the generated keywords based at least in part on the list of configuration data, specification sheet, TARA data and / or cyber model.

[0056] In some examples, the generated keywords comprise attack steps of attack trees. Particularly, in some examples, LLM 40 defines one or more attack trees, or attack paths, from the textual description.

[0057] In some examples, LLM 40 is fine-tuned to generate attack steps from security information. In one illustrative example, the input data used for fine-tuning LLM 40 comprises: a predetermined number of examples of textual descriptions of security information; and a predetermined number of examples of textual attack steps. The term "textual attack step", as used herein, means a textual description of an attack step. Similarly, the term "textual attack path", as used herein, means a textual description of an attack path. Similarly, the term "textual attack tree", as used herein, means a textual description of an attack tree.

[0058] FIG. 2B illustrates a high-level block diagram of a module 100 for fine-tuning LLM 40. Module 100 comprises: a processor 110; a memory 111; and an additional LLM 120. In some examples, memory 111 has stored therein a plurality of instructions that when read by processor 110, causes processor 110 to perform the below described steps.

[0059] FIG. 2C illustrates a high-level flow chart of a method for fine-tuning LLM 40. It is noted that FIGs. 2B - 2C describe one non-limiting implementation for fine-tuning LLM 40, and this is not meant to be limiting in any way. In stage 1100, examples of textual descriptions of security information are input to LLM 40 by processor 110. In stage 1110, a predetermined subset of weights of LLM 40 is fine-tuned by processor 110 for generating textual attack steps from the input textual description of security information. In some examples, stages 1100 and / or 1110, are performed based at least in part on one or more user inputs.

[0060] In stage 1120, in some examples, the output of LLM 40 is input to LLM 120, and the output of LLM 120 is fed to a loss function of LLM 40 to complete the fine-tuning process. However, it is noted that the fine-tuning process can be performed in a variety of ways, as known to those skilled in the art.

[0061] In some examples, in stage 1020, one or more data sources 50 are searched by data retrieval module 30 to retrieve data associated with the received security information of stage 1000. In some examples, the search is performed based at least in part on the generated keywords of stage 1010. It is noted that the term "search", as used herein, is not meant to be limited to any particular form of querying the respective data source / s 50, and any suitable method to query and extract data from each data source 50 can be used. In some examples, data retrieval module 30 performs web scraping to retrieve data from the internet. In some examples, the data retrieved by data retrieval module 30 can include video data, and video to text converter 70 converts the retrieved video to a textual transcription. For example, the video data can include videos explaining / describing one or more vulnerabilities.

[0062] In some examples, the retrieved data is filtered by processor 11 to isolate a predetermined portion of the retrieved data, in accordance with predetermined rules. In some examples, the predetermined rules are used as part of the parameters of the search such that the retrieved data is limited in accordance with the predetermined rules. In some examples, the isolated predetermined portion of the retrieved data is associated with configuration data associated with the asset. For example, in the event that the search retrieves various data associated with a described vulnerability, LLM 40 can filter the retrieved data to only the data that is related to configuration data that are accessed by the asset.

[0063] In some examples, where the predetermined rules are used as part of the parameters of the search, the predetermined rules control the search such that the retrieved data is associated with configuration data associated with the asset.

[0064] In some examples, the predetermined rules are based at least in part of the received cyber-model. Thus, in some examples, the retrieved data, or isolated portion thereof, is most relevant to the respective asset / system. For example, if the search retrieves information regarding a vulnerability in a library, however the vulnerability requires a particular dependency that is not present in the cyber-model, the retrieved information can be discarded.

[0065] In some examples, the isolated predetermined portion of the retrieved data is associated with configuration data that is vulnerable to the attack, vulnerability or potential vulnerability of stage of the security information of stage 1000. In some examples, LLM 40 isolates data regarding such libraries. In some examples, the LLM 40 selects such configuration data only if they are present in the cyber-model.

[0066] In some examples, process 12 ranks the retrieved data, or the isolated portion of the retrieved data in accordance with predetermined ranking rules. For example, where the retrieved data is retrieved from the internet, processor 12 can use a page-rank algorithm, or a variant thereof, to rank the web pages retrieved during the search. In some examples, processor 12 ranks the data based on the relevance thereof to one or more parameters, such as relevance to the attack steps, relevance to the attack tree / s, relevance to the configuration data, relevance to the asset / system, and / or relevance to any other appropriate parameters.

[0067] In some examples, in stage 1025, LLM 40 generates additional keywords, and data retrieval module 30 performs and additional search in data source / s 50 to obtain additional data. In some examples, the additional keywords comprise the identified configuration data of stage 1020. Thus, in such examples, LLM 40 identifies configuration data in stage 1020 (i.e., configuration data that is relevant both to the security information and to the asset) and then presents the identified configuration data as the basis for the additional search.

[0068] In some examples, the additional search is performed to identify additional vulnerabilities associated with this configuration data. Thus, in some examples, LLM 40 filters the retrieved data from the additional search to identify relevant vulnerabilities.

[0069] In some examples, the additional search is performed to identify which versions of the identified configuration data are most relevant. In some examples, the relevance of the versions is based on a predetermined score, and the most relevant versions are those having a score greater than a predetermined threshold. Thus, for example, LLM 40 filters the retrieved data from the additional search to identify one or more particular versions of the respective libraries that are most relevant to the attack. In some examples, the library versions are identified based on a search performed in one or more code repositories, such as a database of exploit code.

[0070] Although stage 1025 is described herein before stage 1030, this is not meant to be limiting in any way. In some examples, the additional search of stage 1025 is performed after stage 1030, as will be described below.

[0071] In some examples, in stage 1030, LLM 40 summarizes at least a portion of the retrieved data of stage 1020 and / or stage 1025. In some examples, the portion of the retrieved data is associated with configuration data associated with the asset, as will be described below. In some examples, as described above, the portion of the retrieved data is associated with additional configuration data as well, that are associated with the attack, the vulnerability or the potential vulnerability. In some examples, the summarization of LLM 40 is done in the Meta Attack Language (MAL).

[0072] In some examples, LLM 40 is trained and / or fine-tuned to summarize the retrieved data. In some examples, LLM 40 is prompted to summarize the retrieved data based at least in part on additional information, the additional information comprising: the configuration data associated with the asset; the TARA data associated with the asset; the specification sheet associated with the asset; and / or the cyber-model associated with the asset. Thus, in some examples, the summarized data conforms to predefined information associated with the asset. In some examples, LLM 40 is further prompted to rank the summarized data.

[0073] In some examples, the summarization is based at least in part on information associated with a previous attack in the asset. In some examples, the summarization is performed to provide a greater emphasis on information related to the previous attack, and / or the summarization includes an indication / summary of the previous attack.

[0074] In some examples, an additional search is performed, as described above in relation to stage 1025. In some examples, the additional search is performed responsive to a respectiveuser input received at user input terminal 45. For example, after receiving summarized data the user can select a predetermined selection which begins the additional search.

[0075] In some examples, in stage 1035, LLM 40 is prompted to analyze the summarized data of stage 1030 to determine a confidence score of the data that is being provided. In some examples, the confidence score is determined for one, or more, of the data retrieval, the data filtering and the summarization of the data. In some examples, LLM 40 is fine-tuned for this purpose. In some examples, the confidence is determined by a second LLM (not shown). The term "confidence score", as used herein, means a value indicating how likely the data is accurate.

[0076] In some examples, in stage 1040, the summarized data is output. In some examples, the summarized data is output to a user terminal and / or to a server.

[0077] In some examples, in stage 1050, a TARA of the asset, stored on memory 12, is updated by processor 11 based at least in part on the summarized data of stage 1030. In some examples, attack trees of the TARA are updated, and / or new attack trees are added to the TARA based on threats identified in the retrieved data. For example, if a new threat is discovered, this threat, along with the appropriate attack tree, can be added to the TARA. In some examples, a risk level of an attack tree, or a threat, is updated based on the summarized data.

[0078] In some examples, LLM 40 is fine-tuned to generate one or more textual attack paths or attack trees based at least in part on the summarized data. In some examples, LLM 40 is fine-tuned to generate textual attack paths / attack trees. In one illustrative example, the input data used for fine-tuning LLM 40 comprises a predetermined number of textual attack paths / attack trees; and a predetermined number of examples of summarized data. In some examples, LLM 40 is first prompted to determine whether the summarized data describes an attack.

[0079] In some examples, LLM 40 is further prompted to assign each generated textual attack step with a tag indicating a category of the attack step, the tag selected from a predetermined list of tags, optionally stored on memory 12. In some examples, each tag provides a category that groups together a plurality of attack steps. One illustrative example of a tag is "unauthorized access". Such a tag will be assigned to any attack step which includes unauthorized access to some point. Another illustrative example of a tag is "vulnerability discovery".

[0080] In some examples, processor 11 updates one or more attack trees, or attack paths, of the TARA data based on the one or more textual attack paths. As described above, in some examples, the TARA data is stored in database 60. FIG. 2D illustrates a high-level flow chart of a method of updating the TARA data based on the one or more textual attack paths.

[0081] In some examples, in stage 1150, LLM 40 is prompted, optionally by processor 11 or by a respective user input, to rank the similarity of the attack steps of the textual attack paths to attack steps of the attack trees, or attack paths, of the TARA data to identify which attack step most closely matches the textual attack step. In some examples, LLM 40 is fine-tuned to match textual attack steps to the stored attack steps of the TARA data. In some examples, prior to the comparison, the stored attack steps are translated to a textual description. Are translated into textual form.

[0082] Although the above has been described in relation to examples where textual attack steps are compared to attack steps of the TARA data, this is not meant to be limiting in any way. In some examples, other portions of the textual attack paths generated by LLM 40 are compared to portions of attack paths / attack trees of the TARA data to identify corresponding portions.

[0083] Although the above has been described in relation to LLM 40, this is not meant to be limiting in any way. In some examples, processor 11 performs a comparison of the textual attack steps to the attack steps of the TARA data using a dedicated algorithm.

[0084] In some examples, in stage 1160, it is determined for each textual attack step, or textual attack path portion, whether a similar attack step, or attack path portion, has been found in the TARA data. In the event that one has not been found for one or more textual attack steps, or attack path portions, in some examples, in stage 1170, summarized data associated with the textual attack step (or textual attack path) is output. In some examples, an additional search of the one or more data sources 50 is performed to obtain additional information associated with the attack step. In some examples, LLM 40 summarizes the additional information as well.

[0085] In some examples, upon identifying one or more attack steps, or attack path portions, in the TARA data, that is sufficiently similar to the textual attack steps, or processor 11 performs one or more of the following steps.

[0086] In some examples, in stage 1180, for each identified attack step, processor 11 updates a feasibility and / or impact value associated with the identified attack step. In some examples, LLM 40 is prompted to generate an updated feasibility / impact value for the identified attack step based on the summarized data. In some examples, LLM 40 is fine-tuned for generating feasibility and / or impact values of attack steps based on summarized data. In some examples, processor 11 runs a dedicated algorithm based on the summarized data for updating the feasibility / impact value.

[0087] In some examples, in stage 1190, one or more attack trees, or attack paths, of the TARA data are updated by processor 11 with the identified attack steps. For example, an identified attack path portion, or identified attack step, can be added to an existing attack tree / attack path. In some examples, adding the attack step / attack path portion can be performed based one or more predetermined rules.

[0088] In some examples, in stage 1195, the identified attack steps, or attack path portions, are combined to generate one or more new attack trees / attack paths.

[0089] In some examples, added attack trees, and / or the textual attack paths, are first verified to see that it meets one or more original parameters of the TARA and / or parameters of the cyber-model. In some examples, processor 11 comprises a logic engine configured to perform the verification.

[0090] In some examples, the cyber-model is updated by processor 11 based at least in part on the retrieved data. For example, in the event that the retrieved data comprises information regarding a vulnerability, or attack, associated with a particular library, and this library is not present in the cyber-model, processor 11 can update the cyber-model according to include the missing library. In another example, if the risk analysis is updated, such as when updating an attack tree and / or a risk level in the risk analysis, processor 11 can update the cyber-model with the updated risk analysis data.

[0091] In some examples, as described above, an output of system 10 comprises one or more of: the summarized data; configuration data, such as a list of libraries, associated with attacks, threats, and / or vulnerabilities; one or more textual attack paths; an update to a TARA of the asset; and an update to information in the cyber-model (e.g., the risk level that is associated with the asset is updated).

[0092] In some examples, LLM 40 is prompted to summarize any updates made to the cyber-model and output the summary.

[0093] FIG. 3 illustrates a high-level flow chart of a method for providing threat intelligence based on a cyber model. The method herein is described in relation to system 10, however this is not meant to be limiting in any way, and any appropriate system can be used for performing the method. In stage 1200, security information associated with an asset is received, the security information comprising a cyber-model of the asset or of a system comprising the asset.

[0094] In some examples, in stage 1210, the cyber-model is analyzed by processor 11 to generate keywords for a search. In some examples, the keywords include configuration data of the cyber-model. In some examples, the keywords are generated by LLM 40. In some examples, LLM 40 is fine-tuned to generate keywords from cyber-models. In some examples, the cyber-model comprises one or more textual descriptions, and LLM 40 extracts keywords from the textual descriptions, as described above in relation to stage 1110.

[0095] In some examples, the search is performed periodically in accordance with a predetermined schedule. In some examples, the search is performed responsive to a respective user input.

[0096] In some examples, in stage 1220, based at least in part on the generated keywords, one or more data sources 50 are searched by data retrieval module 30 to identify vulnerabilities associated with the cyber-model of stage 1200.

[0097] In some examples, the retrieved data is filtered to isolate a predetermined portion of the retrieved data, in accordance with predetermined rules. In some examples, the predetermined rules are used as part of the parameters of the search such that the retrieved data is limited in accordance with the predetermined rules. In some examples, the isolated predetermined portion of the retrieved data is associated with configuration data associated with the asset. For example, in the event that the search retrieves various data associated with a described vulnerability, LLM 40 can filter the retrieved data to only the data that is related to configuration data that are accessed by the asset.

[0098] In some examples, where the predetermined rules are used as part of the parameters of the search, the predetermined rules control the search such that the retrieved data is associated with configuration data associated with the asset.

[0099] In some examples, the predetermined rules are based at least in part of the received cyber-model. Thus, in some examples, the retrieved data, or isolated portion thereof, is most relevant to the respective asset / system. For example, if the search retrieves information regarding a vulnerability in a library, however the vulnerability requires a particular dependency that is not present in the cyber-model, the retrieved information can be discarded.

[0100] In some examples, the isolated predetermined portion of the retrieved data is associated with libraries that are vulnerable to the attack, vulnerability or potential vulnerability of stage of the security information of stage 1200. In some examples, LLM 40 isolates data regarding such libraries. In some examples, the LLM 40 selects such libraries only if they are present in the cyber-model.

[0101] In some examples, processor 12 ranks the retrieved data, or the isolated portion of the retrieved data in accordance with predetermined ranking rules. For example, where the retrieved data is retrieved from the internet, processor 12 can use a PageRank algorithm, or a variant thereof, to rank the web pages retrieved during the search. In some examples, processor 12 ranks the data based on the relevance thereof to one or more parameters, such as relevance to the attack steps, relevance to the attack tree / s, relevance to the configuration data, relevance to the asset / system, and / or relevance to any other appropriate parameters.

[0102] In some examples, in stage 1230, LLM 40 summarizes at least a portion of the retrieved data of stage 1220. In some examples, LLM 40 is prompted, optionally by processor 12, to summarize the portion of the retrieved data that is associated with configuration data contained within the cyber-model, as described above. In some examples, LLM 40 is finetuned to summarize the retrieved data. In some examples, as described above in relation to stage 1030, LLM 40 is prompted to summarize the retrieved data based at least in part on additional information, the additional information comprising: the configuration data, such as a list of libraries, associated with the asset; the risk analysis data associated with the asset; the specification sheet associated with the asset; and / or the cyber-model associated with the asset. In some examples, LLM 40 is further prompted to rank the summarized data.

[0103] In some examples, the summarization is based at least in part on information associated with a previous attack in the asset or system. In some examples, the summarization is performed to provide a greater emphasis on information related to the previous attack, and / or the summarization includes an indication / summary of the previous attack.

[0104] Thus, using generative Al, and particularly retrieval augmented generation (RAG), information regarding vulnerabilities are quickly retrieved and formulated into useful summarized information, as opposed to having multiple analysts working for long periods of time.

[0105] In some examples, in stage 1235, LLM 40 is prompted to analyze the summarized data of stage 1230 to determine a confidence score of the data that is being provided, as described above. In some examples, confidence score is determined for one, or more, of the data retrieval, the data filtering and the summarization of the data. In some examples, LLM 40 is fine-tuned for this purpose. In some examples, the confidence is determined by a second LLM (not shown).

[0106] In some examples, an additional search is performed, as described above in relation to stage 1025.

[0107] In some examples, in stage 1240, a TARA of the asset / system (such as a TARA), stored on memory 12, is updated by processor 11 based at least in part on the summarized data of stage 1230, as described above in relation to stages 1150 - 1195.

[0108] In some examples, the cyber-model is updated based at least in part on the retrieved data. For example, in the event that the retrieved data comprises information regarding a vulnerability, or attack, associated with a particular library, and this library is not present in the cyber-model, processor 11 can update the cyber-model according to include the missing library.

[0109] In some examples, in stage 1250, the summarized data of stage 1230 is output.

[0110] FIG. 4A illustrates a high-level block diagram of a system 200 for identifying communication paths. In some examples, system 200 comprises: a processor 11; a memory 12; a data interface 20; an LLM 210; and an inference engine 220. Although system 200 is described herein as comprising a different LLM than LLM 40 described above, this is not meantto be limiting in any way, and LLM 40 can perform the operations of LLM 210, without exceeding the scope of the disclosure.

[0111] FIG. 4B illustrates a high-level flow chart of a method for using an LLM to identify paths within a system, such as a vehicle system. In some examples, in stage 1400, system documentation is received. In some examples, the documentation comprises, without limitation, one or more of: specification sheets; lists of requirements; TARA; source code; build scripts; and / or makefiles.

[0112] In some examples, in stage 1410, LLM 210 translates the received system documentation of stage 1400 into a formal specification language, such as Temporal Logic of Actions (TLA+). In some examples LLM 40 is fine-tuned, and / or trained, to perform such a translation.

[0113] In some examples, in stage 1420, processor 11 feeds the translated documentation of stage 1410 into inference engine 220. In some examples, processor 11 is configured to query 220 about how to from each point in the system to other points in the system, utilizing one or more protocols from the translated documentation.

[0114] In some examples, in stage 1430, the information of stage 1420 can be used to validate the generated attack trees, or attack paths. The term "validate", as used herein in relation to attack trees, or attack paths, means that the attack tree / attack path can be performed in the relevant system. For example, if an attack tree or attack path is generated (as described above), yet one or more attack steps of the attack tree can't be performed due to the lack of ability of arriving between two points in the system using the respective protocol, the attack tree or attack path is not validated and can be discarded. In some examples, information regarding the attack path, or attack tree, is output, with an indication that one or more attack steps can't be performed in the system.

[0115] In some examples, in stage 1440, the information of stage 1420 can be used to simulate traffic within the system. In some examples, information regarding the simulated traffic is output.Some of the Disclosed

[0116] Some examples of above-described implementations are enumerated below. It should be noted that one feature of an example in isolation or more than one feature of the example taken in combination and, optionally, in combination with one or more features of one or more examples below are examples also falling within the disclosure of this application.

[0117] Example Al. A method for providing threat intelligence, the method comprising: based at least in part on a cyber-model associated with an asset, generating a plurality of keywords; based at least in part on the generated keywords, searching one or more data sources to retrieve data associated with the cyber-model, the retrieved data comprising information regarding threats and / or vulnerabilities associated with the asset; and based at least in part on the retrieved data, updating the cyber-model.

[0118] Example A2. The method of example Al, further comprising utilizing a first large language model (LLM) to summarize at least a portion of the retrieved data, wherein the update of the cyber-model is based at least in part on the summarized data.

[0119] Example A3. The method of example Al or A2, wherein the cyber-model comprises a risk analysis of the asset, and wherein the updating of the cyber-model comprises updating the risk analysis.

[0120] Example A4. The method of any one of examples Al - A3, wherein the updating of the cyber-model comprises updating one or more attack paths.

[0121] Example A5. The method of example A4, further comprising, based at least in part on the retrieved data, identifying one or more attack steps of the one or more attack paths, wherein the updating of the one or more attack paths is based at least in part on the identified one or more attack steps.

[0122] Example A6. The method of any one of examples Al - A5, wherein the updating of the cyber-model comprises adding one or more attack paths.

[0123] Example A7. The method of any one of examples A3 - A6, further comprising: utilizing a second LLM to generate one or more textual attack paths based at least in part on the retrieved data, wherein the update of the cyber-model is based at least in part on the generated one or more textual attack paths.

[0124] Example A8. The method of example A7, further comprising utilizing the LLM to summarize at least a portion of the retrieved data, wherein the update of the cyber-model is based at least in part on the summarized data, and wherein the one or more textual attack paths are based at least in part on the summarized data.

[0125] Example A9. The method of example A7 or A8, further comprising: receiving system documentation; utilizing the LLM to translate the received system documentation to a specification language; feeding the translated documentation to an inference engine; querying the inference engine regarding paths within the system; and based at least in part on the query, validating the output one or more textual attack paths.

[0126] Example A10. The method of any one of examples A7 - A9, when dependent on example 2, wherein the second LLM is the first LLM.

[0127] Example Al l. The method of any one of examples Al - A10, further comprising receiving security information, the security information comprising information regarding an attack in the asset, information regarding a threat to the asset, information regarding a vulnerability in the asset or information regarding a potential vulnerability in the asset, wherein the generation of the keywords are based at least in part of the received security information.

[0128] Example A 12. The method of example Al l, wherein the portion of the retrieved data is associated with configuration data associated with the asset.

[0129] Example A 13. The method of example Al l, wherein the retrieved data is associated with any configuration data that is vulnerable to the attack, vulnerability or potential vulnerability.

[0130] Example A 14. The method of example A 13, further comprising outputting information regarding the configuration data that is vulnerable to the attack, vulnerability or potential vulnerability.

[0131] Example A15. The method of any one of examples A13 - A14, further comprising performing an additional search in the one or more data sources to: identify the most relevant version, or versions, of the configuration data that is vulnerable to the attack, vulnerability or potential vulnerability.

[0132] Example A 16. The method of any one of examples Al 1 - A15, further comprising performing an additional search in the one or more data sources to identify data regarding additional vulnerabilities associated with the configuration data associated with the portion of the retrieved data.

[0133] Example A17. The method of example A16, further comprising receiving a user input regarding the retrieved data associated with the received security information, wherein the additional search is responsive to the received user input.

[0134] Example Al 8. The method of example Al, further comprising receiving security information, the security information comprising information regarding an attack in the asset, information regarding a threat to the asset, information regarding a vulnerability in the asset or information regarding a potential vulnerability in the asset, wherein the generation of the keywords are based at least in part of the received security information, wherein the received security information comprises a textual description, the method further comprising inputting the textual description into an LLM, wherein the plurality of keywords are extracted from the textual description by the LLM.

[0135] Example A19. The method of any one of examples Al - A18, wherein the one or more data sources comprises one or more of: the internet; the dark web; the national vulnerability database (NVD); the open-source vulnerabilities (OSV) database; a database of exploit code; a code repository; a specification sheet associated with the asset; and a risk analysis associated with the asset.

[0136] Example A20. The method of example Al, further comprising utilizing an LLM to rank the retrieved data, the updating of the cyber-model based at least in part on the ranking of the retrieved data.

[0137] Example A21. The method of example A20, wherein the rank comprises a page rank.

[0138] Example A22. The method of example A2, wherein the summarization is based at least in part on information associated with a previous attack in the asset.

[0139] Example A23. The method of example A2, further comprising determining and outputting a confidence score of the summarized data.

[0140] Example A24. The method of example A23, wherein the confidence score is determined by the first LLM.

[0141] Example A25. The method of any one of examples Al - A24, wherein the retrieved data comprises video and / or audio data, the method further comprising converting the video and / or audio data to text.

[0142] Example A26. The method of example Al, further comprising utilizing an LLM to summarize the update to the cyber-model.

[0143] Example 1. The method of any one of examples Al - A26, wherein the cybermodel comprises data regarding connectivity within a system comprising the asset.

[0144] Example A28. The method of example A27, wherein the cyber-model further comprises data regarding connectivity to and from the system.

[0145] Example A29. The method of example A27 or A28, wherein the cyber-model further comprises data regarding software implementations of the asset.

[0146] Example A30. The method of any one of examples A27 - A29, wherein the cybermodel further comprises data regarding threats associated with the asset.

[0147] Example A31. A threat intelligence system for providing threat intelligence comprising one or more processors, and a memory, wherein the memory has stored therein a plurality of instructions, that when run by the one or more processors cause the one or more processors to perform the method of any one of examples Al - A30.

[0148] Example BL A method for providing threat intelligence, the method comprising: receiving security information associated with an asset; based at least in part on the received security information, generating a plurality of keywords; based at least in part on the generated keywords, searching one or more data sources to retrieve data associated with the received security information, the retrieved data comprising information regarding threats and / or vulnerabilities associated with the asset; and utilizing a large language model (LLM) to summarize at least a portion of the retrieved data.

[0149] Example B2. The method of any example herein, particularly example Bl, wherein the security information comprises a cyber-model.

[0150] Example B3. The method of any example herein, particularly example B 1 , wherein the security information comprises information regarding an attack in the asset, information regarding a threat to the asset, information regarding a vulnerability in the asset or information regarding a potential vulnerability in the asset.

[0151] Example B4. The method of any example herein, particularly example B3, wherein the portion of the retrieved data is associated with configuration data associated with the asset.

[0152] Example B5. The method of any example herein, particularly example B3, wherein the retrieved data is associated with any configuration data that is vulnerable to the attack, vulnerability or potential vulnerability.

[0153] Example B6. The method of any example herein, particularly example B5, further comprising outputting information regarding the configuration data that is vulnerable to the attack, vulnerability or potential vulnerability.

[0154] Example B7. The method of any example herein, particularly any one of examples B5 - B6, further comprising performing an additional search in the one or more data sources to: identify the most relevant version, or versions, of the configuration data that are vulnerable to the attack, vulnerability or potential vulnerability.

[0155] Example B8. The method of any example herein, particularly any one of examples B3 - B7, further comprising performing an additional search in the one or more data sources to: identify data regarding additional vulnerabilities associated with the configuration data associated with the portion of the retrieved data; and summarize the retrieved data regarding additional vulnerabilities.

[0156] Example B9. The method of any example herein, particularly example B8, further comprising receiving a user input regarding the summarized data associated with the received security information, wherein the additional search is responsive to the received user input.

[0157] Example B 10. The method of any example herein, particularly any one of examples Bl - B9, further comprising outputting the summarized data.

[0158] Example B 11. The method of any example herein, particularly any one of examples Bl - B10, further comprising updating a risk analysis of the asset based at least in part on the summarized data.

[0159] Example B12. The method of any example herein, particularly example Bl l, wherein the updating the risk analysis comprises updating one or more attack trees and / or adding one or more attack trees.

[0160] Example B13. The method of any example herein, particularly example Bl l or B12, wherein based at least in part on the summarized data, the LLM is fine-tuned to generate one or more textual attack paths, the update of the risk analysis based at least in part on the generated one or more textual attack paths.

[0161] Example B 14. The method of any example herein, particularly any one of examples Bl - B12, wherein based at least in part on the summarized data, the LLM is fune-tuned to generate and output one or more textual attack paths.

[0162] Example B15. The method of any example herein, particularly example B14, further comprising: receiving system documentation; utilizing the LLM to translate the received system documentation to a specification language; feeding the translated documentation to an inference engine; querying the inference engine regarding paths within the system; and based at least in part on the query, validating the output one or more textual attack paths.

[0163] Example B 16. The method of any example herein, particularly any one of examples Bl - B15, wherein the received security information comprises a textual description, the method further comprising inputting the textual description into the LLM, wherein the plurality of keywords are extracted from the textual description by the LLM.

[0164] Example B 17. The method of any example herein, particularly any one of examples Bl - B16, wherein the one or more data sources comprises one or more of: the internet; the dark web the national vulnerability database (NVD); the open-source vulnerabilities (OSV) database; a database of exploit code; a code repository; a specification sheet associated with the asset; and a risk analysis associated with the asset.

[0165] Example B 18. The method of any example herein, particularly any one of examples Bl - B17, wherein the LLM ranks the retrieved data, the portion of the retrieved data selected based at least in part on the rank thereof.

[0166] Example B19. The method of any example herein, particularly example B18, wherein the rank comprises a page rank.

[0167] Example B20. The method of any example herein, particularly any one of examples Bl - B19, wherein the summarization is based at least in part on information associated with a previous attack in the asset.

[0168] Example B21. The method of any example herein, particularly any one of examples Bl - B20, further comprising updating a cyber model associated with the asset, based at least in part on the retrieved data.

[0169] Example B22. The method of any example herein, particularly any one of examples B 1 - B21, further comprising determining and outputting a confidence score of the summarized data.

[0170] Example B23. The method of any example herein, particularly example B22, wherein the confidence score is determined by the LLM.

[0171] Example B24. The method of any example herein, particularly any one of examples Bl - B23, wherein the retrieved data comprises video data, the method further comprising converting the video data to text.

[0172] Example B25. A threat intelligence system comprising one or more processors, and a memory, wherein the memory has stored therein a plurality of instructions, that when run by the one or more processors cause the one or more processors to perform a method, the method comprising: receiving security information associated with an asset, based at least in part on the received security information, generating a plurality of keywords; based at least in part on the generated keywords, searching one or more data sources to retrieve data associated with the received security information, the retrieved data comprising information regarding threats and / or vulnerabilities associated with the asset; and utilizing a large language model (LLM) to summarize at least a portion of the retrieved data.

[0173] It is appreciated that certain features of the invention, which are, for clarity, described in the context of separate embodiments, may also be provided in combination in a single embodiment. Conversely, various features of the invention which are, for brevity,described in the context of a single embodiment, may also be provided separately or in any suitable subcombination.

[0174] Unless otherwise defined, all technical and scientific terms used herein have the same meanings as are commonly understood by one of ordinary skill in the art to which this invention belongs. Although methods similar or equivalent to those described herein can be used in the practice or testing of the present invention, suitable methods are described herein.

[0175] All publications, patent applications, patents, and other references mentioned herein are incorporated by reference in their entirety. In case of conflict, the patent specification, including definitions, will prevail. In addition, the materials, methods, and examples are illustrative only and not intended to be limiting.

[0176] It will be appreciated by persons skilled in the art that the present invention is not limited to what has been particularly shown and described hereinabove. Rather the scope of the present invention is defined by the appended claims and includes both combinations and subcombinations of the various features described hereinabove as well as variations and modifications thereof which would occur to persons skilled in the art upon reading the foregoing description.

Claims

CLAIMS1. A method for providing threat intelligence, the method comprising: based at least in part on a cyber-model associated with an asset, generating a plurality of keywords; based at least in part on the generated keywords, searching one or more data sources to retrieve data associated with the cyber-model, the retrieved data comprising information regarding threats and / or vulnerabilities associated with the asset; and based at least in part on the retrieved data, updating the cyber-model.

2. The method of claim 1, further comprising utilizing a first large language model (LLM) to summarize at least a portion of the retrieved data, wherein the update of the cyber-model is based at least in part on the summarized data.

3. The method of claim 1 or 2, wherein the cyber-model comprises a risk analysis of the asset, and wherein the updating of the cyber-model comprises updating the risk analysis.

4. The method of any one of claims 1 - 3, wherein the updating of the cyber-model comprises updating one or more attack paths.

5. The method of claim 4, further comprising, based at least in part on the retrieved data, identifying one or more attack steps of the one or more attack paths, wherein the updating of the one or more attack paths is based at least in part on the identified one or more attack steps.

6. The method of any one of claims 1 - 5, wherein the updating of the cyber-model comprises adding one or more attack paths.

7. The method of any one of claims 3 - 6, further comprising: utilizing a second LLM to generate one or more textual attack paths based at least in part on the retrieved data, wherein the update of the cyber-model is based at least in part on the generated one or more textual attack paths.

8. The method of claim 7, further comprising utilizing the LLM to summarize at least a portion of the retrieved data, wherein the update of the cyber-model is based at least in part on the summarized data, and wherein the one or more textual attack paths are based at least in part on the summarized data.

9. The method of claim 7 or 8, further comprising: receiving system documentation; utilizing the LLM to translate the received system documentation to a specification language; feeding the translated documentation to an inference engine; querying the inference engine regarding paths within the system; and based at least in part on the query, validating the output one or more textual attack paths.

10. The method of any one of claims 7 - 9, when dependent on claim 2, wherein the second LLM is the first LLM.

11. The method of any one of claims 1 - 10, further comprising receiving security information, the security information comprising information regarding an attack in the asset, information regarding a threat to the asset, information regarding a vulnerability in the asset or information regarding a potential vulnerability in the asset, wherein the generation of the keywords are based at least in part of the received security information.

12. The method of claim 11, wherein the portion of the retrieved data is associated with configuration data associated with the asset.

13. The method of claim 11, wherein the retrieved data is associated with any configuration data that is vulnerable to the attack, vulnerability or potential vulnerability.

14. The method of claim 13, further comprising outputting information regarding the configuration data that is vulnerable to the attack, vulnerability or potential vulnerability.

15. The method of any one of claims 13 - 14, further comprising performing an additional search in the one or more data sources to: identify the most relevant version, or versions, of the configuration data that is vulnerable to the attack, vulnerability or potential vulnerability.

16. The method of any one of claims 11 - 15, further comprising performing an additional search in the one or more data sources to identify data regarding additional vulnerabilities associated with the configuration data associated with the portion of the retrieved data.

17. The method of claim 16, further comprising receiving a user input regarding the retrieved data associated with the received security information, wherein the additional search is responsive to the received user input.

18. The method of claim 1, further comprising receiving security information, the security information comprising information regarding an attack in the asset, information regarding a threat to the asset, information regarding a vulnerability in the asset or information regarding a potential vulnerability in the asset, wherein the generation of the keywords are based at least in part of the received security information, wherein the received security information comprises a textual description, the method further comprising inputting the textual description into an LLM, wherein the plurality of keywords are extracted from the textual description by the LLM.

19. The method of any one of claims 1 - 18, wherein the one or more data sources comprises one or more of: the internet; the dark web; the national vulnerability database (NVD); the open- source vulnerabilities (OSV) database; a database of exploit code; a code repository; a specification sheet associated with the asset; and a risk analysis associated with the asset.

20. The method of claim 1, further comprising utilizing an LLM to rank the retrieved data, the updating of the cyber-model based at least in part on the ranking of the retrieved data.

21. The method of claim 20, wherein the rank comprises a page rank.

22. The method of claim 2, wherein the summarization is based at least in part on information associated with a previous attack in the asset.

23. The method of claim 2, further comprising determining and outputting a confidence score of the summarized data.

24. The method of claim 23, wherein the confidence score is determined by the first LLM.

25. The method of any one of claims 1 - 24, wherein the retrieved data comprises video and / or audio data, the method further comprising converting the video and / or audio data to text.

26. The method of claim 1, further comprising utilizing an LLM to summarize the update to the cyber-model.

27. The method of any one of claims 1 - 26, wherein the cyber-model comprises data regarding connectivity within a system comprising the asset.

28. The method of claim 27, wherein the cyber-model further comprises data regarding connectivity to and from the system.

29. The method of claim 27 or 28, wherein the cyber-model further comprises data regarding software implementations of the asset.

30. The method of any one of claims 27 - 29, wherein the cyber-model further comprises data regarding threats associated with the asset.

31. A threat intelligence system for providing threat intelligence comprising one or more processors, and a memory, wherein the memory has stored therein a plurality of instructions, that when run by the one or more processors cause the one or more processors to perform the method of any one of claims 1 - 30.

Images