|
|
Web application integrating artificial intelligence techniques into the correlation rule creation process
Šibor, Martin ; Caha, Tomáš (referee) ; Safonov, Yehor (advisor)
Currently, as digitalization becomes an integral part of all areas of our lives, the complexity and sophistication of cyber threats are constantly increasing. A key element in the fight against these cyber threats is security monitoring. An important tool for security monitoring are SIEM systems, which allow for early detection and response to potential attacks based on correlation rules. The main contribution of this work is the design and implementation of a web application that integrates artificial intelligence techniques into the process of creating and managing correlation rules for security monitoring systems, with the aim of streamlining the process of creating, modifying, and understanding correlation rules. The work first provides a theoretical introduction to the field of natural language processing and modern neural networks, particularly the transformer architecture, which is the basis of generative artificial intelligence models (e.g., ChatGPT, Gemini). It then introduces the principles of security monitoring, log management systems, the concept of correlation rule generalization, and, last but not least, the challenges associated with managing and maintaining correlation rules, which the integration of artificial intelligence into these processes significantly reduces. The practical part of the work describes the design and implementation of a web application that utilizes the gpt-4 and gpt-3.5-turbo models from OpenAI and the Gemini Ultra 1.0 model from Google for creating new correlation rules, modifying existing rules, and explaining and interpreting them for easier understanding and faster deployment. The application is designed with user-friendliness and efficiency in mind. The results of the work show that the integration of artificial intelligence into the correlation rule creation process brings significant efficiency improvements. The web application allows users to easily create and modify correlation rules. The application also allows users to better understand correlation rules, enabling them to respond to potential threats more quickly.
|
guest ::
