Intelligence Augmentation in a Platform for Cyber Situational Awareness

Abstract

Artificial intelligence improves many cybersecurity areas, from proactive network monitoring to reactive incident handling. Since cybersecurity copes with critical decisions and data, approaches often aim to augment human intelligence instead of replacing it. Intelligence augmentation in mind allows designing tools that empower humans to process larger volumes of data, solve issues faster, and make cybersecurity analysis easier. In this paper, we propose how to apply large language models in the Resilmesh platform for cyber situational awareness. We implemented a visualization panel in the platform's dashboard and a service answering a user's questions concerning the current network state based on the content of a graph database. They were used for orientation in graph data and prioritization of vulnerabilities. Our results reveal that language models, retrieval augmented generation, and meta prompting usually allow answering clear and straightforward questions correctly, while sometimes not strictly following formatting instructions present in prompts. It implies that analysts could create their own analysis easily, quickly, and on demand. Despite several advantages, models must be instructed concerning several details in the future, such as outputting only distinct values from the database and not making up their own results when a question has no answer.