Cyber Sentinel: Exploring Conversational Agents in Streamlining Security Tasks with GPT-4

Mehrdad Kaheh,Danial Khosh Kholgh,Panos Kostakos

DOI: https://doi.org/10.48550/arXiv.2309.16422

2023-09-28

Abstract:In an era where cyberspace is both a battleground and a backbone of modern society, the urgency of safeguarding digital assets against ever-evolving threats is paramount. This paper introduces Cyber Sentinel, an innovative task-oriented cybersecurity dialogue system that is effectively capable of managing two core functions: explaining potential cyber threats within an organization to the user, and taking proactive/reactive security actions when instructed by the user. Cyber Sentinel embodies the fusion of artificial intelligence, cybersecurity domain expertise, and real-time data analysis to combat the multifaceted challenges posed by cyber adversaries. This article delves into the process of creating such a system and how it can interact with other components typically found in cybersecurity organizations. Our work is a novel approach to task-oriented dialogue systems, leveraging the power of chaining GPT-4 models combined with prompt engineering across all sub-tasks. We also highlight its pivotal role in enhancing cybersecurity communication and interaction, concluding that not only does this framework enhance the system's transparency (Explainable AI) but also streamlines the decision-making process and responding to threats (Actionable AI), therefore marking a significant advancement in the realm of cybersecurity communication.

Cryptography and Security

What problem does this paper attempt to address?

The main problem that this paper attempts to solve is, in the current field of network security, in the face of increasingly complex network threats, how to use large - language models (LLMs) to improve the efficiency and effectiveness of network security tasks. Specifically, the paper introduces a dialogue system named "Cyber Sentinel", which aims to solve these problems through the following two core functions:

1. **Explain potential network threats**: Cyber Sentinel can explain to users the possible network threats within an organization, enabling non - expert - level security operators to understand complex threat intelligence.
2. **Take active/passive security measures**: When instructed by users, Cyber Sentinel can perform specific security actions, such as updating firewall rules or adjusting SIEM configurations, to respond to detected threats.

The research questions in the paper focus on two aspects:
- **RQ1**: Can large - language models be used to understand and explain network security logs, events, and threat sources, and fully explain this information to human operators? (Explainable artificial intelligence)
- **RQ2**: Can large - language models take security measures according to the instructions of human operators? (Operable artificial intelligence)

Through these studies, the authors hope to demonstrate the potential of generative artificial intelligence (GenAI) in the network security field, especially by combining the GPT - 4 model and prompt engineering techniques to enhance the transparency of network security communication and interaction and the efficiency of decision - making.