Language Model Incident Response for Security Event Containment

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional detect and response systems in cybersecurity require meticulous manual effort, leading to time delays, scalability issues, inconsistent responses, resource intensity, and challenges in keeping up with the evolving threat landscape due to complex cyberattacks.

Innovation Solution

Deploying a generative AI-driven language model to automate the identification, containment, eradication, and recovery of security incidents, using customizable response plan templates and function calling to execute actions with human oversight.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manual incident response processes are used following PICERL frameworks, then security incidents can be detected and responded to, but the process requires meticulous manual effort leading to time delays and scalability issues

Engineering Contradiction:

Improvesecurity incident detection and responseVSAvoidtime delays in incident response

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent introduces an automated intermediary system that acts as a mediator between security incident detection and manual response actions. This system automatically executes containment, eradication, and recovery steps based on predefined policies, eliminating the time delays associated with manual intervention while maintaining reliable security incident response through structured automated workflows

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent implements preliminary action by pre-configuring response policies and procedures before security incidents occur. These predefined automated response plans include containment strategies, eradication methods, and recovery protocols that are ready to execute immediately upon incident detection, eliminating the need for manual analysis and decision-making during time-critical response phases

Inventive Principle:

Principle #10Preliminary action

2Reliability

If manual incident response processes are used, then security incidents can be managed, but scalability issues arise due to resource intensity

Engineering Contradiction:

Improvesecurity incident managementVSAvoidscalability of incident response

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent enables self-service by designing an automated response system that independently executes security incident containment, eradication, and recovery operations without requiring continuous manual resource allocation. The system autonomously manages incident response workflows, allowing organizations to scale security operations without proportionally increasing human resources

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent implements universality through a multi-functional automated response platform that handles diverse security incident types using standardized policies and procedures. This universal system can respond to various threats (malware, ransomware, phishing, DDoS) with the same infrastructure, dramatically improving scalability without requiring specialized manual teams for each incident type

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Reliability

If manual incident response is performed, then security threats can be addressed, but inconsistent responses occur across different incidents

Engineering Contradiction:

Improvesecurity threat responseVSAvoidconsistency of incident response

Core Design Contradiction:

ReliabilityVSStability of the object's composition

Solution Approach 1:

The patent applies parameter changes by systematically varying response actions based on incident parameters such as threat type, severity level, affected systems, and organizational policies. The automated system adjusts containment strategies, eradication methods, and recovery procedures according to these parameters, ensuring consistent and appropriate responses across different incident scenarios while maintaining reliability

Inventive Principle:

Principle #35Parameter changes

4Reliability

If manual effort is used for incident response, then security incidents can be detected and contained, but the process is resource intensive

Engineering Contradiction:

Improveincident detection and containmentVSAvoidmanual resource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent extracts the resource-intensive manual analysis and decision-making components from the incident response process, separating them into automated policy-based execution. This extraction eliminates the need for continuous human resource consumption during incident response while maintaining reliable detection and containment through automated system actions

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS20250373628A1Responding to security incidents using language models

Publication Date: 2025.12.04 CISCO TECHNOLOGY INC

AI summary

Techniques for providing a language model to detect and remedy a security incident are described. A language model is deployed to respond to prompts from network operators. The language model receives a prompt from the network operator indicating actions to take based on trigger events. When a trigger event occurs, the language model receives a description of a potential security incident and identifies indicators of compromise in the description. The language model calls one or more other models to analyze the indicators and receives from the one or more other models, information indicating that the potential security incident is a real security incident, and outputs a prompt to the network operator to approve confirmation of the security incident.