Generative AI Prompting for Accurate Cybersecurity RQL Rules
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity policies are not well-represented in publicly available resource query language (RQL) for foundation models, limiting their ability to generate effective cybersecurity rules.
Innovation Solution
A system utilizing generative artificial intelligence (AI) to deduce cybersecurity rules in RQL by inputting a textual description, selecting an API name, and leveraging a knowledge base to build a prompt that guides the AI to generate queries in RQL, incorporating data models and example queries to enhance accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional symbolic machine learning approaches are used for rule induction, then rule generation can be achieved, but the quality and effectiveness of cybersecurity rules are limited due to lack of public RQL policy data
Solution Approach 1:
The system copies existing cybersecurity policies from multiple sources and transforms them into RQL format. By replicating and adapting existing policy structures rather than generating rules from scratch, the system overcomes the scarcity of public RQL policy data while maintaining rule effectiveness
Solution Approach 2:
The system performs preliminary data collection and policy transformation work by gathering cybersecurity policies from various sources and pre-processing them into RQL format. This advance preparation creates a foundation of training data that enables subsequent effective rule generation without requiring extensive public RQL datasets
2Adaptability or versatility
If generative AI is used to generate cybersecurity rules in RQL, then rule generation capability is enhanced, but the accuracy is limited without sufficient training data
Solution Approach 1:
The system performs preliminary data collection and policy transformation work by gathering cybersecurity policies from various sources and pre-processing them into RQL format. This advance preparation creates a foundation of training data that enables subsequent effective rule generation without requiring extensive public RQL datasets
Solution Approach 2:
The system uses a multi-functional approach by collecting policies from diverse sources (commercial vendors, open-source communities, government agencies) and processing them through a unified transformation pipeline. This universal data collection strategy creates a comprehensive training dataset that improves both the adaptability and accuracy of the generative AI model
3Measurement precision
If manual policy creation is used, then high accuracy can be achieved, but the productivity and efficiency are low
Solution Approach 1:
The system enables self-service rule generation by allowing the generative AI model to automatically create cybersecurity rules in RQL format from collected policy data. This automated self-service approach maintains high accuracy through learned patterns while dramatically improving productivity by eliminating manual rule creation bottlenecks
Solution Approach 2:
The system incorporates feedback mechanisms where generated rules are evaluated and refined. The model learns from the quality of generated rules and adjusts its generation process accordingly, maintaining high accuracy while enabling automated high-volume rule production that improves overall productivity
Data Source
AI summary
A textual description of a rule/query is input to the disclosed system and a name of an application programming interface (API) is selected based on the textual description. With the API name, other parameters to guide rule induction are determined-a data model relevant to the API name and a pair of corresponding query examples in in a reference programming language and in a target programming language also relevant to the API name. A prompt is then built based on a template, the textual description, the API name, and the additional parameters. The API name and additional parameters can be considered context for task instructions in the prompt. The system submits the prompt to a foundation model to acquire a query in in the target programming language.