Architectural Framework for Automated Incident Response: Leveraging LLMs and Classifiers for Rapid Postattack Analysis and Reporting
摘要
With the sheer volume of attacks and a lack of escalation and collaboration tools in handling post-attack analysis, it has become incredibly difficult to understand the severity of an incident post-identification. This challenge highlights the need for an effective and swift solution to reduce the post-incident response time. Post-incident response time must be reduced to minimize the potential for further loss of data, system damage, and financial impact. Manual analysis is often slow and error-prone, making it a less efficient methodology, whereas automation helps improve response time and accuracy in reducing losses for an organization more efficiently. This paper proposes a method to accomplish this by elaboration of the whole process from identification to correlation to eradication. By integrating machine learning-based classifiers with the reasoning capabilities of Large Language Models, this methodology can be regarded as a very novel and comprehensive method for threat identification, correlation, and eradication. The paper suggests an end-to-end pipeline where structured logs from different sources, like Suricata, Wazuh, System Event Logs, email logs, etc., are parsed and classified, then sent to an LLM model for further processing, identification, and interpretation. The LLM then construct an attack timeline based on the processed data, followed by preparing a comprehensive report outlining the probable timestamps, the attack surface targeted, possible Indicators of Compromise (IoC), an attack flow, and the available mitigations for the same. The purpose is to drastically reduce post-incident response analysis time from days to possibly hours, ensuring a safe and effective response mechanism augmenting the human effort that goes into the same.