As cited
Copy frozen at (site build).
Using LLMs and ESRE to find similar user sessions
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
research
Using LLMs and ESRE to find similar user sessions
Researchers experimented with GPT-4 and ELSER (Elastic's semantic search model) to categorize and find similarities in Linux user sessions for threat detection. GPT-4 achieved 56% accuracy in single-category classification when aligned with security expert labels, with few-shot learning improving performance by 20%, while semantic search with ELSER outperformed keyword-based approaches for conceptual queries but struggled to distinguish related categories.
Why it matters: Security analysts can leverage large language models (LLMs) and semantic search to identify suspicious session patterns and related user behaviors, though current accuracy levels and limitations in distinguishing closely related activity categories require further tuning before operational deployment.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
research
Using LLMs and ESRE to find similar user sessions
Researchers experimented with GPT-4 and ELSER (Elastic's semantic search model) to categorize and find similarities in Linux user sessions for threat detection. GPT-4 achieved 56% accuracy in single-category classification when aligned with security expert labels, with few-shot learning improving performance by 20%, while semantic search with ELSER outperformed keyword-based approaches for conceptual queries but struggled to distinguish related categories.
Why it matters: Security analysts can leverage large language models (LLMs) and semantic search to identify suspicious session patterns and related user behaviors, though current accuracy levels and limitations in distinguishing closely related activity categories require further tuning before operational deployment.
- Source published
- First seen by Cybersecurity Tracker