What Does an LLM-Powered Threat Intelligence Program Look Like?
summary
Defines a three-part CTI framework: visibility, processing, interpretation, and shows LLMs converting large raw sources (logs, packets, slide images) into standardized outputs, translating foreign-language material, and doing first‑level RE for simple binaries. Cites case studies (AP1: 74 pages 3,000 IOCs, CrowdStrike CA‑Cleaner: 10 pages 20 IOCs, Krebs merge analysis) and demonstrates risks: an LLM misclassifies a malicious invoice PDF leading to breach, a chatbot hallucinates 2 of 5 malware families. Recommends human‑in‑loop, private models, RLHF, and tool/plugin integration.
AI-written summary · about
chapters (6)
- 0:00LLM threat intelligence intro
- 6:06Threat intelligence framework
- 12:09LLMs processing impact
- 18:36Mitigating LLM hallucinations
- 25:37Implementing LLMs in CTI
- 36:05Q&A on LLM usage and error rates
related talks
28mSupercharging Threat Intelligence with AI
39mThreat Modeling Using LLMs
39mLLMs everywhere: The future is now and the past keeps repeating itself
47mHarnessing LLMs for Next-Level Security Analysis
43mLLMs in a Hacker's Hands: From Prompt Injection to Data Leakage
38mNext-Gen Detection: Harnessing LLMs for Sigma Rule Automation
20mSecurity Threats in Modern LLM Applications
50mSecuring LLM-Powered Applications: Overcoming Security and Privacy Challenges