LLM-Assisted Proactive Threat Intelligence for Automated Reasoning

2025-04-01

AI Summary

Traditional static threat analysis struggles to cope with dynamic cyber threats. To address this, we propose a real-time cyber threat intelligence system integrating the large language model GPT-4o with Retrieval-Augmented Generation (RAG). The system automatically ingests multi-source, time-varying threat data—including CVE, CWE, EPSS, and KEV—via Patrowl; for the first time, it embeds RAG into GPT-4o to overcome its inherent static knowledge limitations, enabling millisecond-level injection of up-to-date threat intelligence. Furthermore, we design a cybersecurity-oriented vector fusion framework for heterogeneous, multi-source intelligence, leveraging the all-mpnet-base-v2 encoder and Milvus to build an efficient semantic retrieval module. Experimental results demonstrate substantial improvements in detection accuracy and response latency for newly disclosed vulnerabilities, KEV entries, and high-EPSS CVEs—outperforming the baseline GPT-4o model across all evaluated metrics.

Technology Category

• Computer Vision: Large Vision Models
• Intelligent Robots: Multimodal Perception & Sensor Fusion
• Data Mining & Knowledge Management: Conversational Systems for Recommendation & Retrieval

Application Category

• Search and Retrieval-Augmented AI: Retrieval-Augmented Generation (RAG) and multi-modal RAG
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

Successful defense against dynamically evolving cyber threats requires advanced and sophisticated techniques. This research presents a novel approach to enhance real-time cybersecurity threat detection and response by integrating large language models (LLMs) and Retrieval-Augmented Generation (RAG) systems with continuous threat intelligence feeds. Leveraging recent advancements in LLMs, specifically GPT-4o, and the innovative application of RAG techniques, our approach addresses the limitations of traditional static threat analysis by incorporating dynamic, real-time data sources. We leveraged RAG to get the latest information in real-time for threat intelligence, which is not possible in the existing GPT-4o model. We employ the Patrowl framework to automate the retrieval of diverse cybersecurity threat intelligence feeds, including Common Vulnerabilities and Exposures (CVE), Common Weakness Enumeration (CWE), Exploit Prediction Scoring System (EPSS), and Known Exploited Vulnerabilities (KEV) databases, and integrate these with the all-mpnet-base-v2 model for high-dimensional vector embeddings, stored and queried in Milvus. We demonstrate our system's efficacy through a series of case studies, revealing significant improvements in addressing recently disclosed vulnerabilities, KEVs, and high-EPSS-score CVEs compared to the baseline GPT-4o. This work not only advances the role of LLMs in cybersecurity but also establishes a robust foundation for the development of automated intelligent cyberthreat information management systems, addressing crucial gaps in current cybersecurity practices.

Problem

• Enhancing real-time cybersecurity threat detection using LLMs and RAG
• Overcoming limitations of static threat analysis with dynamic data
• Automating retrieval of diverse threat intelligence feeds for proactive defense

Innovation

• Integrates LLMs and RAG for real-time threat detection
• Uses Patrowl to automate threat intelligence retrieval
• Combines high-dimensional embeddings with Milvus for queries