Lightning Talk: Enhance Investigations Using LLM, Embeddings, and Clustering
2Generative AI and Large Language Models (LLM) have become increasingly popular over the last couple of years. The attackers are using this technology to gain advantages, thus, so should the defenders. This session will examine an innovative method of utilizing a LLM, an embedding model, and a Machine Learning clustering algorithm in concert to help overcome some common limitations of GenAI when applying it to larger datasets of forensic data commonly found in DFIR investigations. The technique that will be demonstrated can be a handy tool to have for triaging certain types of data points such as command line executions. This method will first be demonstrated via Jupyter Notebook to show the fun technical details of how and why this method works, then, an open-source tool that can run against native Windows Event Logs will be released and demonstrated that automates this method allowing you to partake in the fun!
SANS AI in Cybersecurity Summit 2024
Lightning Talk
Enhance Investigations Using LLM, Embeddings, and Clustering
Speaker: Matthew Seyer, Director, KPMG, LLP
View upcoming Summits: http://www.sans.org/u/DuS