Sophos, a global leader in next-generation innovation and cyber security, recently released a new research paper. A recent report titled ‘GPT for You and Me: Applying AI Language Processing to Cyber Defense’ details Sophos X-Ops’ projects. The research shows how GPTThree, the language model of the currently popular ChatGPT framework, can serve the cybersecurity industry as a tool to help prevent cyber attackers.
Research on how GPTThree’s large language models can make it easier for security software to detect malicious activity in datasets. Even spam filtering and ‘Living of the Land’ binary (LOLBIN) attack analysis can be done quickly with these language models.
Sean Gallagher, principal threat researcher at Sophos, said: ‘After the unveiling of ChatGPT as OpenAI, the security community is paying close attention to the potential risks of this new technology. Because will AI help potential attackers write malware or cybercriminals write phishing emails? At Sophos, we’ve long viewed AI as an ally rather than an enemy. It is also seen as a cornerstone for Sophos. Security organizations should not only focus on potential risks, as GPT3 opens many doors.’
Sophos X-Ops researchers, including Yanghu Li, chief data scientist at SophosAI, are working on three prototype projects. All three projects used a technique called ‘few-shot learning’ to train the AI model with a few data samples, which greatly reduced the need for previously classified data collection.
Sophos first application tests the learning method in a few shots. Whereas, it was a natural language query interface for shifting through malicious activity in security software telemetry. Specifically, Sophos tested the model against its endpoint detection and product response.
Sophos tested a new spam filter using ChatGPT. It found that the filters used by GPT3 were significantly more accurate when compared to other machine learning models for spam filtering. Finally, Sophos researchers were able to create a program to simplify the process of reverse-engineering LOLbins’ command line. Such reverse-engineering is always difficult. But it is important to understand LOLbins behavior and stop such attacks in future.
