Large Language Models (AI) applications to Cybersecurity

Overview The field of Artificial Intelligence is taking the industry (and the world) by storm. The launch of ChatGPT started a mass adoption phenomenon, which is now followed by an avalanche of new products and solutions addressing every possible problem space. Malicious hackers have also put AI to good use, but so did the White Hat hackers, such as Frédéric and his team. This talk will level-set the understanding about Large Language Models (LLM) and Generative AI for computer scientists and software developers who might not be intimately familiar with the field. Frédéric will then take us further into some of the applications in cybersecurity. Abstract Large Language Models and Generative AI have completely reshaped the landscape of Artificial Intelligence the last two years. Progresses have been made on architectures, training methods, and the community has shared large datasets along with pre-trained models, allowing for new usages at a relatively low cost. In the cybersecurity defender’s path, new malicious tools drove efforts on innovative methods to improve their detection. We propose a modern and effective method of detecting file maliciousness, by using an LLM initially trained on computer code. The focus will be on the process we set up and the decision we made to solve this problem, with an emphasize of the generalization of our approach. We will explain how LLM can help solve a large panel of problems related to texts. In addition, we will explain the outcomes of this work : in particular, we will explain how we were able to use the trained model and ask it “where it was wrong”, shedding lights on errors in the training datasets. We will explain where these errors came from, and how we were able to improve the model iteratively by correcting them, allowing more people to reproduce our findings and fixing pitfalls coming with noisy datasets. Working in a field where sometimes the line is thin between an “administrator” and a “threat actor”, we will also open the discussion on how you can define maliciousness depending on your objectives. Key takeaways : -What is an LLM and what it is not? -How much does it cost to use one for our own purpose? -What are the key steps of a training process? -An intro to cybersecurity : what are we trying to detect? -How did we build our datasets? -The results -What can the data engineer and the cybersecurity analyst learn from these results? Co-sponsored by: CIS 2024 | Use this IEEE Promo Code and enjoy 30% off your registration: IEEE_CIS2024 Speaker(s): Frédéric Grelot, Marc Lijour Agenda: 6 pm Welcome and introductions by Marc Lijour 6:30 pm – 7:30 pm Talk: “Demystifying AI and Large Language Models through a concrete use case” by Frédéric Grelot Followed by Q&As 7:30 pm Networking 8 pm The end Room: ENGLG11 , Bldg: George Vari Engineering and Computing Centre (ENG), 245 Church Street, lower level , Toronto, Ontario, Canada, Virtual: https://events.vtools.ieee.org/m/412758