Applied Machine Learning and AI in cybersecurity is slowly growing into mainstream industry, not just as an add-on anymore. As threat actors have started automating and streamlining a lot of their attack pipelines using off the shelf Large Language Models, the good actors are essentially forced to catch up with them ! It’s not just about addressing the low hanging fruits anymore – we need a major overhaul of automating cybersecurity practices that can essentially address problems like phishing and social engineering, insider threat and essentially loss of privileged data in any form, and the cost incurred due to these. In this article, we will explore some use cases of large language models in cybersecurity.
- Threat Intelligence and Analysis: Cybersecurity products in general produce vast amounts of log data – be it system data, alerts, incidents (suspicious or out-right malicious), analyst notes, event logs, SIEM logs etc. There is always a data trail, what better use case can there be for a beast of a language model to slurp in that data and spit out all kinds of summaries, analyses, classifications and so on! We can use these to gather data from text forums like social media, security blogs, dark web forums, even convert videos to text and in turn to usable data and build complex datasets to build deterministic security models and machine learning models that empowers organizations to proactively strengthen their defenses and stay one step ahead of potential cyberattacks.
- Malware Detection: Malware is constantly evolving, making it increasingly challenging to detect and mitigate. Large language models can analyze the behavior, structure, and content of files, emails, and network traffic to identify potential indicators of malicious activity. LLMs can detect anomalies in text-based communication, identify suspicious patterns, and provide real-time alerts to security teams, significantly enhancing malware detection and prevention.
- Automated Threat Hunting: Traditionally, threat hunting has been a manual and time-consuming process for cybersecurity professionals. With large language models, organizations can automate various aspects of threat hunting. LLMs can comb through vast amounts of log files, network traffic data, and security events to identify patterns, anomalies, and potential threats. By automating this process, LLMs assist security analysts in efficiently sifting through data and focusing their efforts on investigating and mitigating genuine threats. Even before LLMs, this was possible through an NLP technique called Topic Modeling (I had written an article on this for my previous employer Capsule8- read it here), but with LLMs, this can be supercharged!!
- Phishing and Social Engineering Detection: Phishing attacks and social engineering remain prevalent vectors for cybercriminals. LLMs can analyze email content, URLs, and social media posts to identify suspicious patterns and indicators of phishing attempts. By leveraging their natural language understanding capabilities, LLMs can detect social engineering techniques, such as impersonation and manipulation, helping organizations minimize the risk of falling victim to these deceptive tactics.
- Incident Response and Chatbot Support: During a cyber incident, organizations face immense pressure to respond swiftly and effectively. Large language models can support incident response teams by providing real-time guidance and recommendations based on their understanding of cybersecurity best practices and historical incident data. Moreover, LLM-powered chatbots can assist with basic user inquiries, incident triaging, and initial response, freeing up human analysts to focus on critical tasks and accelerating incident resolution.
- Secure Code Review: Software vulnerabilities often serve as entry points for cyberattacks. Large language models can aid in secure code review by analyzing source code, documentation, and developer forums. By leveraging their contextual understanding and knowledge of best practices, LLMs can identify potential vulnerabilities, suggest code improvements, and ensure adherence to secure coding standards, helping organizations build more resilient software systems.
My prediction is – Applying Large Language Models effectively – given its challenges like productionalizing it, given the stochastic nature of its output, and the sheer cost going into its training and inference – is going to be the key differentiator for a lot of the AI cybersecurity products out there. Once you figure out a way to optimize the aforementioned challenges regarding productionalizing the Large Language Models, you are gonna eons ahead!
Infinite Couch 