Multi-Tiered Language Models for Secure Automated Cybersecurity Testing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing LLM-based automated security testing systems face challenges in generating effective security test patterns without exposing sensitive system configuration details and fail to account for the severity of obtained information, often relying on single LLMs and lacking comprehensive data management.
Innovation Solution
A cybersecurity testing system utilizing a high-accuracy public LLM and a domain-specific local LM, with a management server and scan module to manage and convert sensitive information, ensuring secure and accurate security test pattern generation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single LLM is used for automated security testing, then the system complexity is reduced, but the ability to handle diverse information formats and prevent information leakage deteriorates
Solution Approach 1:
The patent divides the LLM functionality into two separate models: a public LLM for general security testing and a local LM for sensitive information processing. This segmentation allows each model to specialize in specific tasks, with the local LM handling information leakage prevention while the public LLM performs general security analysis, thereby maintaining security without requiring a single complex model to handle all functions.
Solution Approach 2:
The patent introduces a data management server as an intermediary component that coordinates between the scan module, local LM, and public LLM. This intermediary manages the flow of sensitive information, ensuring that the local LM processes sensitive data while the public LLM receives sanitized information, thus preventing information leakage while maintaining system functionality.
2Reliability
If a local LM is used for security testing, then information leakage is prevented, but the accuracy for general security testing deteriorates
Solution Approach 1:
The patent segments the LLM functions by using a local LM specifically for processing sensitive information and generating sanitized prompts, while using a public LLM for general security testing and analysis. This segmentation allows the public LLM to maintain high accuracy for general security testing while the local LM ensures information security, with each model optimized for its specific function.
Solution Approach 2:
The data management server acts as an intermediary that receives sensitive information from the scan module, processes it through the local LM to generate sanitized prompts, and then sends these prompts to the public LLM for accurate security analysis. This intermediary ensures that the public LLM receives cleaned, sanitized data that maintains testing accuracy while preventing information leakage.
3Productivity
If sensitive system configuration information is provided to the LLM, then effective security test patterns are generated, but information leakage occurs
Solution Approach 1:
The local LM serves as an intermediary that receives sensitive system configuration information from the scan module, processes this information to generate sanitized prompts that maintain testing effectiveness but remove sensitive data, and then transmits these sanitized prompts to the public LLM. This intermediary ensures that effective test patterns are generated without causing information leakage.
Solution Approach 2:
The patent creates a copy of the sensitive information processing function by using the local LM to generate sanitized versions of prompts that maintain the essential testing information while removing sensitive data. This copying approach allows the public LLM to receive simplified prompts that are sufficient for effective security testing without containing sensitive information that could leak.
4Quantity of substance
If public LLMs are used for security testing, then cost is reduced and updates are automatic, but information leakage risk increases
Solution Approach 1:
The patent segments the LLM usage by reserving public LLMs for general security testing tasks where cost efficiency and automatic updates are beneficial, while reserving local LMs for processing sensitive information. This segmentation allows the system to benefit from the cost-effectiveness and automatic updates of public LLMs for general tasks while using local LMs to prevent information leakage when handling sensitive data.
Solution Approach 2:
The local LM acts as an intermediary layer between the scan module and the public LLM, ensuring that sensitive information is processed and sanitized before being sent to the public LLM. This intermediary protects against information leakage while allowing the system to continue using cost-effective public LLMs for general security testing operations.
Data Source
AI summary
Cost-effective cyber security risk countermeasure systems and methods enable LLM-based automated security testing for managed cybersecurity services, without leaking sensitive information about target systems. In embodiments, this is accomplished by utilizing flexible local language models that identify and filter target system specific information when communicating with a public large language model to obtain highly accurate security testing patterns.