Design of a hybrid information security management system based on artificial intelligence technologies

Abstract

The process of managing cybersecurity operations that include continuous monitoring, detection, analysis, and response to cyber threats, aimed at protecting the organization's digital assets, has been investigated in this study. The task addressed is to improve the efficiency and speed of automated incident response by combining deterministic pre-filtering tools with the cognitive capabilities of language models (LLMs). In the course of the research, an architecture of a multi-agent information security management system (MAS-ISM) has been designed, which operates on the basis of decentralized coalition auctions and a hybrid risk analysis subsystem (Sandwich Engine) for express search of incidents in system event logs for automated generation of expert reports in the state language using the generation technology supplemented by Retrieval-Augmented Generation (RAG) and LLM search. The solution to the tasks of obtaining technical cybersecurity reports in the state language and recommendations for further decision-making by the analyst has been shown. The main difference of the hybrid risk assessment system from existing ones is the use of deterministic retrospective session isolation, which made it possible to ensure data confidentiality, automatic expert description of the current state of cybersecurity in the national language, and the compilation of recommendations for analysts. The research results are attributed to the combined use of AI methods: RAG technology, deterministic retrospective session isolation, and LLM. The total time for analyzing one complex incident and forming a structured expert SOC report in the state language was reduced to 12 seconds (compared to 15–45 minutes under traditional manual analysis), while guaranteeing the confidentiality of critical data from leakage into the public cloud circuit