Generative artificial intelligence for cybersecurity event detection

Abstract

This project proposes a novel approach to cybersecurity event detection using Generative Artificial Intelligence, while combining the Semantic Pivoting model for Effective Event Detection (SPEED). The research leverages the Cybersecurity Event Annotation Corpus (CEAC), a dataset of annotated cybersecurity new articles, to finetune and evaluate our models. The increasing frequency and challenge of cyberattacks requires better and quicker methods for detecting and analysing cybersecurity events. Not to mention, there is an increasing amount of content being released onto the internet. Our approach uses various models to detect the events. Subsequently, we summarise to reduce the length of texts while retaining the content to further detect the events in the texts. Next, we fine-tune the models on the CASIE dataset, aiming to enhance its ability to identify and classify various cybersecurity events, including data breaches, phishing attacks, ransomware incidents, and vulnerability discoveries. SPEED model demonstrated superior performance when compared to various robust baselines on benchmark datasets such as ACE 2005 for event detection. The SPEED model is integrated to improve event detection accuracy by leveraging semantic relationships within the text. This combination of Generative AI and semantic analysis allows for a more robust understanding of cybersecurity events. Our methodology involves preprocessing the CASIE dataset, summarising the content, fine-tuning the models on cybersecurity-specific language, and implementing the SPEED model for enhanced event detection, where we evaluate our approach using standard metrics.