LOCALINTEL: Generating Organizational Threat Intelligence from Global and Local Cyber Knowledge
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2024
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866910819301720064 |
|---|---|
| author | Mitra, Shaswata Neupane, Subash Chakraborty, Trisha Mittal, Sudip Piplai, Aritran Gaur, Manas Rahimi, Shahram |
| author_facet | Mitra, Shaswata Neupane, Subash Chakraborty, Trisha Mittal, Sudip Piplai, Aritran Gaur, Manas Rahimi, Shahram |
| contents | Security Operations Center (SoC) analysts gather threat reports from openly accessible global threat repositories and tailor the information to their organization's needs, such as developing threat intelligence and security policies. They also depend on organizational internal repositories, which act as private local knowledge database. These local knowledge databases store credible cyber intelligence, critical operational and infrastructure details. SoCs undertake a manual labor-intensive task of utilizing these global threat repositories and local knowledge databases to create both organization-specific threat intelligence and mitigation policies. Recently, Large Language Models (LLMs) have shown the capability to process diverse knowledge sources efficiently. We leverage this ability to automate this organization-specific threat intelligence generation. We present LocalIntel, a novel automated threat intelligence contextualization framework that retrieves zero-day vulnerability reports from the global threat repositories and uses its local knowledge database to determine implications and mitigation strategies to alert and assist the SoC analyst. LocalIntel comprises two key phases: knowledge retrieval and contextualization. Quantitative and qualitative assessment has shown effectiveness in generating up to 93% accurate organizational threat intelligence with 64% inter-rater agreement. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2401_10036 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | LOCALINTEL: Generating Organizational Threat Intelligence from Global and Local Cyber Knowledge Mitra, Shaswata Neupane, Subash Chakraborty, Trisha Mittal, Sudip Piplai, Aritran Gaur, Manas Rahimi, Shahram Cryptography and Security Artificial Intelligence Information Retrieval Logic in Computer Science Security Operations Center (SoC) analysts gather threat reports from openly accessible global threat repositories and tailor the information to their organization's needs, such as developing threat intelligence and security policies. They also depend on organizational internal repositories, which act as private local knowledge database. These local knowledge databases store credible cyber intelligence, critical operational and infrastructure details. SoCs undertake a manual labor-intensive task of utilizing these global threat repositories and local knowledge databases to create both organization-specific threat intelligence and mitigation policies. Recently, Large Language Models (LLMs) have shown the capability to process diverse knowledge sources efficiently. We leverage this ability to automate this organization-specific threat intelligence generation. We present LocalIntel, a novel automated threat intelligence contextualization framework that retrieves zero-day vulnerability reports from the global threat repositories and uses its local knowledge database to determine implications and mitigation strategies to alert and assist the SoC analyst. LocalIntel comprises two key phases: knowledge retrieval and contextualization. Quantitative and qualitative assessment has shown effectiveness in generating up to 93% accurate organizational threat intelligence with 64% inter-rater agreement. |
| title | LOCALINTEL: Generating Organizational Threat Intelligence from Global and Local Cyber Knowledge |
| topic | Cryptography and Security Artificial Intelligence Information Retrieval Logic in Computer Science |
| url | https://arxiv.org/abs/2401.10036 |