Using LLMs to Automate Threat Intelligence Analysis Workflows in Security Operation Centers

2024/07/18 by Pei-Yu Tseng, Tseng, PeiYu, Yeh, ZihDwo +4 · 3 citations
Computer Science · #Cryptography and Security (cs.CR) #Digital and Cyber Forensics #FOS: Computer and information sciences #Information and Cyber Security #Network Security and Intrusion Detection

paper · pdf · doi:10.48550/arxiv.2407.13093

openalex publication_date 2024/07/18 · openalex created_date 2025/01/04 · openalex updated_date 2026/07/28

Abstract

SIEM systems are prevalent and play a critical role in a variety of analyst workflows in Security Operation Centers. However, modern SIEMs face a big challenge: they still cannot relieve analysts from the repetitive tasks involved in analyzing CTI (Cyber Threat Intelligence) reports written in natural languages. This project aims to develop an AI agent to replace the labor intensive repetitive tasks involved in analyzing CTI reports. The agent exploits the revolutionary capabilities of LLMs (e.g., GPT-4), but it does not require any human intervention.

Cited by

• RulePilot: An LLM-Powered Agent for Security Rule Generation
• REx86: A Local Large Language Model for Assisting in x86 Assembly Reverse Engineering
• Advancing Autonomous Incident Response: Leveraging LLMs and Cyber Threat Intelligence

Related

• LLMs in the SOC: An Empirical Study of Human-AI Collaboration in Security Operations Centres
• AI-Driven Cyber Threat Intelligence Automation
• Large Language Models for Security Operations Centers: A Comprehensive Survey
• CTIArena: Benchmarking LLM Knowledge and Reasoning Across Heterogeneous Cyber Threat Intelligence
• CyberSOCEval: Benchmarking LLMs Capabilities for Malware Analysis and Threat Intelligence Reasoning