Interpretable Incident Inspector Based on Large-Scale Language Model and Association Mining

Explore an innovative approach to incident analysis in this 40-minute Black Hat conference talk. Discover how combining a large-scale language embedding model with a frequent association algorithm can extract significant tokens, providing strong interpretability for incident similarity in feature space representation. Learn about the contextual comprehension capabilities of the LLM that ensure robustness against input variations. Examine the practical application of this method to a global visibility platform processing over 200 million events per day. Gain insights into how the generated significant tokens clearly identify reasons for attributing incidents to specific APT groups. Compare the results of this method with security analyst feedback, offering diverse analytical perspectives for incident investigation.

IRonMAN: InterpRetable Incident Inspector Based ON Large-Scale Language Model and Association miNing