LLM Security Analysis Agents for False Positive Event Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing complexity of computing environments leads to a surge in events or alerts, many of which are false positives, requiring manual investigation, which is inefficient and time-consuming.
Innovation Solution
Implementing security analysis agents that utilize large language models (LLMs) to evaluate events, generate prompts, and classify them, excluding false positives based on performance scores, thereby automating the identification of irrelevant alerts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If monitoring technology is installed to detect activities in computing environments, then security detection capability is improved, but the number of false positive events increases
Solution Approach 1:
The patent introduces an LLM-based analysis agent as an intermediary between monitoring technology and security analysts. This agent automatically evaluates events, determines whether they represent actual security threats or false positives, and provides reasoned assessments. The agent acts as a mediator that filters and interprets raw security events, reducing the burden on human analysts while maintaining high detection accuracy.
2Reliability
If the number of monitoring events increases to cover more security aspects, then security coverage is improved, but manual investigation workload increases
Solution Approach 1:
The patent implements a self-service mechanism where LLM-based analysis agents automatically evaluate and classify security events without requiring manual intervention. Each agent independently analyzes events, determines their significance, and provides assessments that can be acted upon automatically or with minimal human oversight. This self-service approach handles the increasing volume of security events generated by comprehensive monitoring coverage.
Solution Approach 2:
The patent replaces the mechanical system of manual event investigation with an automated LLM-based analysis system. Instead of security analysts manually examining each event, the system uses language models to automatically interpret, evaluate, and classify events. This substitution dramatically reduces the time and effort required for security event analysis while maintaining or improving detection quality.
3Reliability
If comprehensive monitoring is implemented in heterogeneous environments, then security monitoring capability is improved, but system complexity increases
Solution Approach 1:
The patent implements universal LLM-based analysis agents that can handle multiple types of security events across heterogeneous computing environments through a single unified system. The agents are designed to be multi-functional, capable of analyzing various event types (malware, intrusions, anomalies, etc.) and adapting to different environments without requiring separate specialized systems for each scenario.
Data Source
AI summary
Embodiments are directed to security analysis agents. Events associated with a computing environment may be provided. Prompt fragments may be determined based on the events. A prompt may be generated for a large language model (LLM) based on a prompt template and the prompt fragments such that the prompt fragments may be included in the prompt and provided to the LLM. Actions for evaluating the events may be determined based on the LLM response. These actions may be executed to evaluate the events. Portions of the response that correspond to the prompt fragments may be determined. A performance score may be determined for each prompt fragment based on its corresponding portion of the response such that the prompt may be modified to exclude a portion of the prompt fragments that have a performance score less than a threshold value.