LLM Cybersecurity Event Attribution for Real-Time Risk Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Corporate cybersecurity risks have become increasingly complex due to asymmetric, distributed, and networked threats, making it difficult for corporations to manage and update their cybersecurity risk scores accurately.
Innovation Solution
A method utilizing a trained large language model (LLM) to identify and verify cybersecurity events, update risk scores, and provide documentation, incorporating domain matching and expert rules to ensure accuracy and relevance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional cybersecurity risk assessment methods are used, then the system is simpler to operate, but the accuracy and responsiveness of risk scoring deteriorates
Solution Approach 1:
The patent introduces an LLM-based intermediary layer that processes unstructured text data from multiple sources and transforms it into structured cybersecurity event information. This intermediary handles the complexity of data integration and analysis, enabling accurate risk scoring without requiring the end system to directly manage the complexity of multiple data sources and processing methods.
Solution Approach 2:
The patent replaces traditional mechanical rule-based systems with an LLM-based intelligent system that can naturally understand and process unstructured text data. This substitution enables the system to automatically extract meaningful information from diverse sources without requiring manual configuration of complex extraction rules for each data type.
2Reliability
If manual verification of cybersecurity events is performed, then false positives are reduced, but the productivity and real-time update capability deteriorates
Solution Approach 1:
The system implements self-service through automated entity verification using domain information and similarity comparison. The LLM automatically extracts entity identifiers from text data, compares them against known domain information, and determines whether events are new or duplicates without human intervention. This maintains high detection accuracy while enabling real-time processing.
Solution Approach 2:
The patent incorporates feedback mechanisms where the system continuously learns from verified events and updates its entity knowledge base. This feedback loop improves the accuracy of entity identification and event verification over time, reducing false positives while maintaining high processing speeds through increasingly accurate automated comparisons.
3Adaptability or versatility
If multiple data sources are integrated, then the comprehensiveness of cybersecurity event detection is improved, but the difficulty of detecting and measuring deteriorates
Solution Approach 1:
The patent implements a universal LLM-based processing framework that handles multiple types of unstructured text data from diverse sources (news articles, security reports, social media, etc.) using the same core methodology. This universal approach simplifies the integration of multiple data sources by providing a single interface for processing various formats and types of cybersecurity information.
Solution Approach 2:
The system segments the complex task of multi-source data integration into distinct processing stages: text extraction, entity identification, event verification, and risk scoring. Each stage handles a specific aspect of the processing pipeline, making the overall system more manageable and easier to implement despite the diversity of input sources.
4Measurement precision
If entity verification using domain information is implemented, then the attribution accuracy of cybersecurity events is improved, but the loss of time in processing deteriorates
Solution Approach 1:
The patent applies partial verification by comparing only critical entity attributes (such as domain names or key identifiers) against known information rather than performing complete entity verification. This partial approach maintains high attribution accuracy for the most important identifying features while significantly reducing the time required for verification processing.
Data Source
AI summary
The present disclosure presents methods and systems for determining cybersecurity risk exposure for entities. In one aspect, a method is provided that includes providing first text data to a trained LLM to identify data associated with a first candidate cybersecurity event for an entity, comparing the entity's identifier to domain information to verify the entity's identifier, determining if the first candidate cybersecurity event represents a new cybersecurity event based on com with previous data, and updating a cybersecurity risk score for the entity based on this determination. Further enhancements include training the LLM with cybersecurity event data, outputting documentation of the event source, and various methods for evaluating the novelty and severity of the cybersecurity event, including similarity measures and manual review triggers. The techniques leverage LLMs, machine learning models, and automated actions to provide a comprehensive approach to cybersecurity risk assessment and response. Other aspects are also provided.