LOCALINTEL: Generating Organizational Threat Intelligence from Global and Local Cyber Knowledge
CoRR(2024)
摘要
Security Operations Center (SoC) analysts gather threat reports from openly
accessible global threat databases and customize them manually to suit a
particular organization's needs. These analysts also depend on internal
repositories, which act as private local knowledge database for an
organization. Credible cyber intelligence, critical operational details, and
relevant organizational information are all stored in these local knowledge
databases. Analysts undertake a labor intensive task utilizing these global and
local knowledge databases to manually create organization's unique threat
response and mitigation strategies. Recently, Large Language Models (LLMs) have
shown the capability to efficiently process large diverse knowledge sources. We
leverage this ability to process global and local knowledge databases to
automate the generation of organization-specific threat intelligence.
In this work, we present LOCALINTEL, a novel automated knowledge
contextualization system that, upon prompting, retrieves threat reports from
the global threat repositories and uses its local knowledge database to
contextualize them for a specific organization. LOCALINTEL comprises of three
key phases: global threat intelligence retrieval, local knowledge retrieval,
and contextualized completion generation. The former retrieves intelligence
from global threat repositories, while the second retrieves pertinent knowledge
from the local knowledge database. Finally, the fusion of these knowledge
sources is orchestrated through a generator to produce a contextualized
completion.
更多查看译文
AI 理解论文
溯源树
样例
生成溯源树,研究论文发展脉络
Chat Paper
正在生成论文摘要