Development And Performance Evaluation of a Generative AI-Based Adaptive Cybersecurity Framework Integrating Threat Intelligence, Attack Prediction and Automated Incident Response
Keywords:
SOAR, SIEM, Retrieval-Augmented Generation, Large Language Models, Machine Learning, Automated Incident Response, Attack Prediction, Threat Intelligence, Adaptive Cybersecurity, Generative Artificial IntelligenceAbstract
The increasing frequency and sophistication of cyberattacks have created significant challenges for organisations in protecting their digital infrastructure, information systems and sensitive data. Conventional cybersecurity approaches primarily depend on predefined rules, signature-based detection and manual incident investigation. Although these approaches remain useful, they often struggle to identify emerging threats, predict attack behaviour and respond effectively to rapidly changing cyber environments. The development of Generative Artificial Intelligence (GenAI) provides new opportunities for designing adaptive cybersecurity systems capable of analysing complex security information and supporting intelligent decision-making.
The present research proposes a Generative AI-based adaptive cybersecurity framework integrating threat intelligence, attack prediction and automated incident response. The framework combines machine learning, large language models, Retrieval-Augmented Generation (RAG), Security Information and Event Management (SIEM), and Security Orchestration, Automation and Response (SOAR). It aims to analyse security events, identify potential attack patterns, estimate threat severity and recommend appropriate response strategies. A feedback mechanism is incorporated to improve system adaptability, while human supervision is retained for sensitive security operations.
References
Bender, E.M., Gebru, T., McMillan-Major, A. and Shmitchell, S. (2021) ‘On the dangers of stochastic parrots: Can language models be too big?’, Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency, pp. 610–623.
Bishop, C.M. (2006) Pattern Recognition and Machine Learning. New York: Springer.
Brown, T.B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G. and Askell, A. et al. (2020) ‘Language models are few-shot learners’, Advances in Neural Information Processing Systems, 33, pp. 1877–1901.
Buczak, A.L. and Guven, E. (2016) ‘A survey of data mining and machine learning methods for cyber security intrusion detection’, IEEE Communications Surveys & Tutorials, 18(2), pp. 1153–1176.
Cichonski, P., Millar, T., Grance, T. and Scarfone, K. (2012) Computer Security Incident Handling Guide. NIST Special Publication 800-61 Revision 2. Gaithersburg, MD: National Institute of Standards and Technology.
Dwork, C. and Roth, A. (2014) ‘The algorithmic foundations of differential privacy’, Foundations and Trends in Theoretical Computer Science, 9(3–4), pp. 211–407.
Gama, J., Žliobaitė, I., Bifet, A., Pechenizkiy, M. and Bouchachia, A. (2014) ‘A survey on concept drift adaptation’, ACM Computing Surveys, 46(4), Article 44.
Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T. and Fritz, M. (2023) ‘Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection’, Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security, pp. 79–90.
Guo, C., Pleiss, G., Sun, Y. and Weinberger, K.Q. (2017) ‘On calibration of modern neural networks’, Proceedings of the 34th International Conference on Machine Learning, PMLR 70, pp. 1321–1330.
He, H. and Garcia, E.A. (2009) ‘Learning from imbalanced data’, IEEE Transactions on Knowledge and Data Engineering, 21(9), pp. 1263–1284.
Kent, K. and Souppaya, M. (2006) Guide to Computer Security Log Management. NIST Special Publication 800-92. Gaithersburg, MD: National Institute of Standards and Technology.
McMahan, B., Moore, E., Ramage, D., Hampson, S. and Agüera y Arcas, B. (2017) ‘Communication-efficient learning of deep networks from decentralized data’, Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, PMLR 54, pp. 1273–1282.
National Institute of Standards and Technology (2024) Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. NIST AI 600-1. Gaithersburg, MD: NIST.
Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z.B. and Swami, A. (2017) ‘Practical black-box attacks against machine learning’, Proceedings of the 2017 ACM Asia Conference on Computer and Communications Security, pp. 506–519.
Rudin, C. (2019) ‘Stop explaining black box machine learning models for high stakes decisions and use interpretable models instead’, Nature Machine Intelligence, 1, pp. 206–215.
Scarfone, K. and Mell, P. (2007) Guide to Intrusion Detection and Prevention Systems (IDPS). NIST Special Publication 800-94. Gaithersburg, MD: National Institute of Standards and Technology.
Downloads
How to Cite
Issue
Section
License
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
