LOCALINTEL: Generating Organizational Threat Intelligence from Global and Local Cyber Knowledge

2024-01-18

arXiv.org

AI Summary

To address the low efficiency of security operations center (SOC) analysts in manually integrating global threat intelligence repositories with local knowledge bases, this paper proposes a two-stage large language model (LLM)-based automation framework. In Stage I, the framework fuses structured and unstructured local knowledge with heterogeneous, multi-source global threat data to enable precise threat retrieval. In Stage II, it performs organization-level impact analysis and mitigation strategy generation for zero-day vulnerabilities via credibility-weighted prompt engineering and contextualized reasoning. The framework introduces the first global–local knowledge co-modeling mechanism, enabling real-time, customizable threat intelligence production. Experimental evaluation demonstrates 93% intelligence accuracy and 64% expert agreement—substantially improving response timeliness and mitigation strategy adaptability.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Search and Optimization: Local Search
• Natural Language Processing: Safety and Robustness

Application Category

• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs

Abstract

Security Operations Center (SoC) analysts gather threat reports from openly accessible global threat repositories and tailor the information to their organization's needs, such as developing threat intelligence and security policies. They also depend on organizational internal repositories, which act as private local knowledge database. These local knowledge databases store credible cyber intelligence, critical operational and infrastructure details. SoCs undertake a manual labor-intensive task of utilizing these global threat repositories and local knowledge databases to create both organization-specific threat intelligence and mitigation policies. Recently, Large Language Models (LLMs) have shown the capability to process diverse knowledge sources efficiently. We leverage this ability to automate this organization-specific threat intelligence generation. We present LocalIntel, a novel automated threat intelligence contextualization framework that retrieves zero-day vulnerability reports from the global threat repositories and uses its local knowledge database to determine implications and mitigation strategies to alert and assist the SoC analyst. LocalIntel comprises two key phases: knowledge retrieval and contextualization. Quantitative and qualitative assessment has shown effectiveness in generating up to 93% accurate organizational threat intelligence with 64% inter-rater agreement.

Problem

• Automate organization-specific threat intelligence generation
• Integrate global and local cyber knowledge databases
• Enhance accuracy and efficiency for SoC analysts

Innovation

• Automates threat intelligence generation
• Integrates global and local knowledge
• Utilizes Large Language Models