TLDR: The research paper investigates how Security Operations Center (SOC) personnel use Large Language Models (LLMs) like GPT-4 during live cybersecurity operations. Using two topic modeling approaches (BERTopic and a novel GPT-4 based method), the study found that SOC operators primarily leverage LLMs to understand complex text strings, such as command lines, and to assist with tasks like composing threat reports. The findings suggest that designing collaborative LLM tools tailored to these common use cases can significantly enhance SOC workflows and efficiency.
Large Language Models (LLMs) are rapidly transforming various industries, and cybersecurity is no exception. A recent research paper, titled Collaborative Intelligence: Topic Modelling of Large Language Model use in Live Cybersecurity Operations, delves into how cybersecurity specialists in Security Operations Centers (SOCs) are voluntarily integrating LLMs into their critical, high-pressure work environments. Authored by Dr. Martin Lochner from eSentire and the University of Waterloo, and Dr. Keegan Keplinger from SpyCloud, this study offers valuable insights into the practical applications of AI in live security operations.
The core objective of the research was to gain a deeper understanding of how SOC personnel utilize LLMs to support their daily tasks. SOC analysts are responsible for rapidly detecting, preventing, addressing, and remediating security breaches, a role that demands extensive knowledge and quick decision-making. The paper highlights that while human-automation teams have been studied for decades, the advent of transformer-based language models has ushered in a new era of collaboration, making human-AI partnerships more practical and effective.
To achieve their objective, the researchers analyzed a dataset comprising 10 months of SOC operators’ interactions with GPT-4 via an internally deployed chat application. They employed two distinct topic modeling exercises. The first utilized the established BERTopic model, a powerful tool that uses transformer-based language models to identify coherent topics from text. The second approach was a novel, two-shot topic modeling workflow that leveraged GPT-4 itself as the primary engine for topic extraction and classification, aiming for a more semantically rich understanding of user intent.
Key Findings from BERTopic Analysis
The BERTopic analysis of 3787 individual LLM interactions revealed 90 summary categorizations. The most prominent use cases, accounting for nearly 14% of all LLM usage, revolved around understanding complex command lines. For instance, topics like ‘powershell get system object’ and ‘command does do what’ indicated that operators frequently sought assistance in interpreting PowerShell commands and other shell scripts. Other significant topics included help in composing or rephrasing threat reports and questions about authentication methods. While BERTopic provided a good initial overview, the researchers noted that inferring the exact semantic meaning of these word-group categorizations still required manual interpretation.
Novel GPT-4 Based Topic Modeling for Deeper Insights
Recognizing the limitations of purely word-frequency-based topic modeling, the researchers developed a novel approach using GPT-4 to infer the intent behind SOC operator queries. This two-shot method involved first asking GPT-4 to extract 12 use-case categories from blocks of 100 LLM calls, then reducing these to a final set of 20 high-level use cases (plus an ‘other’ category). In the second step, each individual LLM message was classified into one of these 21 categories, along with an unconstrained sub-category for finer granularity.
This advanced modeling approach confirmed and expanded upon the initial findings. It clearly demonstrated that SOC operators predominantly use LLMs for ‘Command Line Operations,’ which includes command explanation, analysis, and interpretation. This category alone accounted for 29% of total responses. Other significant primary use cases identified included ‘Threat Summaries,’ ‘Content Generation,’ and ‘Rephrasing Message Content.’ The ‘Other’ category, representing 13.6% of interactions, captured general questions, casual greetings, and feedback to the LLM.
Also Read:
- Rethinking How We Interact with AI: Insights from a Design Thinking Workshop on LLM Interfaces
- Investigating Trust Dynamics Among Large Language Models: Explicit Declarations vs. Implicit Behaviors
Implications for Cybersecurity Tool Development
The research underscores that SOC operators find particular benefit in LLMs when dealing with the technical complexity of their work, such as analyzing intricate commands, network packets, custom threat hunting rules, and obfuscated code. The natural tendency of these specialists to leverage LLMs for interpreting complex text strings indicates a clear pathway for designing more effective collaborative AI tools for SOC environments.
A practical application stemming from this work could be the development of in-line tools, such as a right-click context menu, that allows operators to execute command-line analysis LLM calls directly within their SOC environment, eliminating the need for manual copy-pasting to a separate chat interface. Such incremental improvements in workflow could significantly boost the overall efficiency of SOC operations and enhance the cybersecurity posture of clients.
In conclusion, this study provides a unique and valuable perspective on the real-world application of LLMs in cybersecurity. It not only confirms the primary ways SOC personnel use these powerful AI tools but also offers clear guidance for developers to create next-generation, AI-augmented tools that seamlessly integrate into existing SOC workflows, fostering a more intelligent and efficient security operations center.
